# joi (npm) vulnerabilities 7 known vulnerabilities (2 high, 3 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 18.3.2 (Nov 4, 2026): no advisory affects it - Newest unaffected release: 18.3.2 (Nov 4, 2026), the latest release - Weekly downloads: 34.6M - Dependents: 1,187 - Releases: 263 since 0.0.1 (Sep 16, 2012) - Registry: https://www.npmjs.com/package/joi - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-122131: 17.2.0 to 17.13.5 (17.13.6 is outside it); 18.0.0 to 18.2.4 (18.2.5 is outside it) - CVE-2026-118772: 17.1.1 to 17.13.8 (17.13.9 is outside it); 18.0.0 to 18.3.0 (18.3.1 is outside it) - CVE-2026-92599: 17.2.0 to 17.13.6 (17.13.7 is outside it); 18.0.0 to 18.2.5 (18.2.6 is outside it) - CVE-2026-90771: 0.0.1 to 17.13.7 (17.13.8 is outside it); 18.0.0 to 18.2.8 (18.2.9 is outside it) - CVE-2026-84368: 17.2.0 to 17.13.5 (17.13.6 is outside it); 18.0.0 to 18.2.4 (18.2.5 is outside it) - CVE-2026-84367: 17.1.1 to 17.13.4 (17.13.5 is outside it); 18.0.0 to 18.2.3 (18.2.4 is outside it) - CVE-2026-48038: 0.0.1 to 17.13.3 (17.13.4 is outside it); 18.0.0 to 18.2.0 (18.2.1 is outside it) ## Advisories (7) ### [CVE-2026-122131](https://cve.now/CVE-2026-122131): Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via proto Language Key - Severity: Medium 6.3 - Published: Nov 4, 2026 - Affected: from 17.2.0, fixed in 17.13.6; from 18.0.0, fixed in 18.2.5. - Fixed in 17.13.6 (released Aug 19, 2026, 77 days before disclosure) and 18.2.5 (released Aug 19, 2026, 77 days before disclosure). - The latest release, 18.3.2, is not affected. - 51% of joi downloads last week were affected versions (20.2M). ### [CVE-2026-118772](https://cve.now/CVE-2026-118772): joi: quadratic-time split in \`string().email({ multiple: true })\` allows denial of service - Severity: High 7.5 - Published: Oct 29, 2026 - Affected: from 17.1.1, fixed in 17.13.9; from 18.0.0, fixed in 18.3.1. - Fixed in 17.13.9 (released Oct 28, 2026, 1 day before disclosure) and 18.3.1 (released Oct 28, 2026, 1 day before disclosure). - The latest release, 18.3.2, is not affected. - 73% of joi downloads last week were affected versions (28.6M). ### [CVE-2026-92599](https://cve.now/CVE-2026-92599): Joi before 17.13.7 and 18.2.6 ReDoS via isoDate - Severity: High 8.7 - Published: Sep 16, 2026 - Affected: from 17.2.0, fixed in 17.13.7; from 18.0.0, fixed in 18.2.6. - Fixed in 17.13.7 (released Sep 2, 2026, 14 days before disclosure) and 18.2.6 (released Sep 2, 2026, 14 days before disclosure). - The latest release, 18.3.2, is not affected. - 53% of joi downloads last week were affected versions (20.8M). ### [CVE-2026-90771](https://cve.now/CVE-2026-90771): joi before 17.13.8 and 18.2.9 Prototype Pollution via messages - Severity: Medium 6.3 - Published: Sep 13, 2026 - Affected: fixed in 17.13.8; from 18.0.0, fixed in 18.2.9. - Fixed in 17.13.8 (released Sep 11, 2026, 2 days before disclosure) and 18.2.9 (released Sep 11, 2026, 2 days before disclosure). - The latest release, 18.3.2, is not affected. - 58% of joi downloads last week were affected versions (22.8M). ### [CVE-2026-84368](https://cve.now/CVE-2026-84368): joi: Prototype pollution via a \`proto\` language key in custom messages - Severity: Low 3.7 - Published: Sep 1, 2026 - Affected: from 17.2.0, fixed in 17.13.6; from 18.0.0, fixed in 18.2.5. - Fixed in 17.13.6 (released Aug 19, 2026, 13 days before disclosure) and 18.2.5 (released Aug 19, 2026, 13 days before disclosure). - The latest release, 18.3.2, is not affected. - 51% of joi downloads last week were affected versions (20.2M). ### [CVE-2026-84367](https://cve.now/CVE-2026-84367): joi: object().rename() with a template target can set the validated object's prototype - Severity: Low 3.7 - Published: Sep 1, 2026 - Affected: from 16.0.0, fixed in 17.13.5; from 18.0.0, fixed in 18.2.4. - Fixed in 17.13.5 (released Aug 19, 2026, 13 days before disclosure) and 18.2.4 (released Aug 19, 2026, 13 days before disclosure). - The latest release, 18.3.2, is not affected. - 51% of joi downloads last week were affected versions (20.2M). ### [CVE-2026-48038](https://cve.now/CVE-2026-48038): joi: Uncaught RangeError on deeply nested input through recursive \`link()\` schemas - Severity: Medium 5.3 - Published: Jul 14, 2026 - Affected: from 18.0.0, fixed in 18.2.1; fixed in 17.13.4. - Fixed in 17.13.4 (released Jun 12, 2026, 32 days before disclosure) and 18.2.1 (released May 4, 2026, 71 days before disclosure). - The latest release, 18.3.2, is not affected. - 46% of joi downloads last week were affected versions (17.9M). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/joi Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.