npmPackage

joi

7 known vulnerabilities (2 high, 3 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release: 18.3.2 (Nov 4, 2026): no advisory affects it
Newest unaffected release: 18.3.2 (Nov 4, 2026), the latest release
Advisories: 7 · 2 high, 3 medium, 2 low

Weekly downloads: 34.6M
Dependents: 1,187
Releases: 263 since 0.0.1 (Sep 16, 2012)
Registry: npm
Releases read: Nov 8, 2026

Version timeline

CVE-2026-122131
Affects 17.2.0 to 17.13.5 (17.13.6 is outside it); 18.0.0 to 18.2.4 (18.2.5 is outside it)
CVE-2026-118772
Affects 17.1.1 to 17.13.8 (17.13.9 is outside it); 18.0.0 to 18.3.0 (18.3.1 is outside it)
CVE-2026-92599
Affects 17.2.0 to 17.13.6 (17.13.7 is outside it); 18.0.0 to 18.2.5 (18.2.6 is outside it)
CVE-2026-90771
Affects 0.0.1 to 17.13.7 (17.13.8 is outside it); 18.0.0 to 18.2.8 (18.2.9 is outside it)
CVE-2026-84368
Affects 17.2.0 to 17.13.5 (17.13.6 is outside it); 18.0.0 to 18.2.4 (18.2.5 is outside it)
CVE-2026-84367
Affects 17.1.1 to 17.13.4 (17.13.5 is outside it); 18.0.0 to 18.2.3 (18.2.4 is outside it)
CVE-2026-48038
Affects 0.0.1 to 17.13.3 (17.13.4 is outside it); 18.0.0 to 18.2.0 (18.2.1 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

CVE-2026-122131Medium 6.3
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Key
Affected: from 17.2.0, fixed in 17.13.6; from 18.0.0, fixed in 18.2.5.
Fixed in 17.13.6 (released Aug 19, 2026, 77 days before disclosure) and 18.2.5 (released Aug 19, 2026, 77 days before disclosure).
The latest release, 18.3.2, is not affected.
51% of joi downloads last week were affected versions (20.2M).
CVE-2026-118772High 7.5
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
Affected: from 17.1.1, fixed in 17.13.9; from 18.0.0, fixed in 18.3.1.
Fixed in 17.13.9 (released Oct 28, 2026, 1 day before disclosure) and 18.3.1 (released Oct 28, 2026, 1 day before disclosure).
The latest release, 18.3.2, is not affected.
73% of joi downloads last week were affected versions (28.6M).
CVE-2026-92599High 8.7
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Affected: from 17.2.0, fixed in 17.13.7; from 18.0.0, fixed in 18.2.6.
Fixed in 17.13.7 (released Sep 2, 2026, 14 days before disclosure) and 18.2.6 (released Sep 2, 2026, 14 days before disclosure).
The latest release, 18.3.2, is not affected.
53% of joi downloads last week were affected versions (20.8M).
CVE-2026-90771Medium 6.3
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Affected: fixed in 17.13.8; from 18.0.0, fixed in 18.2.9.
Fixed in 17.13.8 (released Sep 11, 2026, 2 days before disclosure) and 18.2.9 (released Sep 11, 2026, 2 days before disclosure).
The latest release, 18.3.2, is not affected.
58% of joi downloads last week were affected versions (22.8M).
CVE-2026-84368Low 3.7
joi: Prototype pollution via a `proto` language key in custom messages
Affected: from 17.2.0, fixed in 17.13.6; from 18.0.0, fixed in 18.2.5.
Fixed in 17.13.6 (released Aug 19, 2026, 13 days before disclosure) and 18.2.5 (released Aug 19, 2026, 13 days before disclosure).
The latest release, 18.3.2, is not affected.
51% of joi downloads last week were affected versions (20.2M).
CVE-2026-84367Low 3.7
joi: object().rename() with a template target can set the validated object's prototype
Affected: from 16.0.0, fixed in 17.13.5; from 18.0.0, fixed in 18.2.4.
Fixed in 17.13.5 (released Aug 19, 2026, 13 days before disclosure) and 18.2.4 (released Aug 19, 2026, 13 days before disclosure).
The latest release, 18.3.2, is not affected.
51% of joi downloads last week were affected versions (20.2M).
CVE-2026-48038Medium 5.3
joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas
Affected: from 18.0.0, fixed in 18.2.1; fixed in 17.13.4.
Fixed in 17.13.4 (released Jun 12, 2026, 32 days before disclosure) and 18.2.1 (released May 4, 2026, 71 days before disclosure).
The latest release, 18.3.2, is not affected.
46% of joi downloads last week were affected versions (17.9M).