CVE-2026-84368: joi Package Prototype Pollution via Custom Messages
Summary
CVE-2026-84368: joi: Prototype pollution via a proto language key in custom messages. Affects joi across 2 version ranges.
>= 17.2.0, < 17.13.6
>= 18.0.0, < 18.2.5
Fixed in 17.13.6 or 18.2.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The joi package is a popular JavaScript library used for schema validation, allowing developers to define and validate data structures in a flexible manner. It provides a rich set of features for data validation, including custom messages for error handling. However, a vulnerability has been identified that allows for prototype pollution through the misuse of custom message configurations.
Vulnerability Detail
The vulnerability arises when an application passes untrusted data into joi's custom message configuration methods, such as messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). An attacker can exploit this by using keys like 'proto' or 'constructor', which can lead to the modification of Object.prototype. This means that any object in the application can inherit these malicious properties, potentially altering application behavior and leading to unauthorized access or manipulation of data.
How To Fix
Latest published version: 18.3.0 as of 23 Oct 2026
npm install joi@18.3.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 17.2.0, < 17.13.617.13.6npm install joi@17.13.6 -
>= 18.0.0, < 18.2.518.2.5npm install joi@18.2.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid passing untrusted input into the custom message configuration methods. Ensure that any input does not contain 'proto' or 'constructor' properties. For example, you can validate the input before using it in the messages configuration:
const userInput = getUserInput();
if (!userInput.__proto__ && !userInput.constructor) {
joi.messages(userInput);
}
Conclusion
The CVE-2026-84368 vulnerability in the joi package poses a significant risk due to prototype pollution via custom messages. It is essential for developers using joi to upgrade to the latest patched versions and implement the recommended workarounds to safeguard their applications.
See every vulnerability recorded for joi →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, leading to unexpected behavior in applications.
You can check if your application is affected by using tools like Vulert, which monitors your package-lock.json for vulnerabilities in real-time.
If an immediate upgrade is not possible, implement the suggested workarounds to mitigate the risk until you can update to a secure version.
Failing to address this vulnerability can lead to unauthorized access, data manipulation, and potential breaches in application security.
Yes, the vulnerability affects joi versions starting from 17.2.0 up to 17.13.6 and 18.0.0 up to 18.2.5. Upgrading to the patched versions is crucial.
References
Related vulnerabilities
Recent vulnerabilities recorded for joi.
