CVE-2026-92599: Joi Package Vulnerability Due to Quadratic Regular-Expression Backtracking
Summary
CVE-2026-92599: joi: Quadratic regular-expression backtracking in Joi.string().isoDate(). Affects joi across 2 version ranges.
>= 17.2.0, < 17.13.7
>= 18.0.0, < 18.2.6
Fixed in 17.13.7 or 18.2.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Joi is a popular JavaScript library used for schema validation, allowing developers to define and validate the structure of data in applications. It provides a rich set of features for validating various data types, including strings, numbers, and arrays. However, a recent vulnerability has been identified in the Joi library that affects the Joi.string().isoDate() method, potentially leading to performance issues in applications that rely on this validation.
Vulnerability Detail
The vulnerability arises from an unanchored regular expression used in the Joi.string().isoDate() method. When a valid ISO date is followed by a long sequence of fractional-second digits, the regex engine may restart its search from every position in the string. This results in a performance degradation that is proportional to the square of the input length, leading to significant delays. For instance, processing a string with 64 KB of digits can take approximately 1.4 seconds, while 256 KB can take around 22 seconds. This can cause applications to stall and become unresponsive, impacting user experience and system performance.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 17.2.0, < 17.13.717.13.7npm install joi@17.13.7 -
>= 18.0.0, < 18.2.618.2.6npm install joi@18.2.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, you can cap the length of the string input before it reaches Joi for validation. This can be done by implementing a check in your application code to limit the input size. For example:
if (inputString.length > MAX_LENGTH) {
throw new Error('Input string is too long.');
}
Conclusion
The vulnerability identified as CVE-2026-92599 in the Joi package poses a significant risk to applications that utilize the Joi.string().isoDate() method for validation. By upgrading to the recommended patched versions, developers can mitigate this risk and ensure their applications remain responsive and performant.
See every vulnerability recorded for joi →
FAQ
CVE-2026-92599 is a vulnerability in the Joi package that allows for quadratic regular-expression backtracking, potentially leading to application stalls.
If your application uses Joi's isoDate() validation, it may become unresponsive when processing long strings, affecting user experience.
Versions 17.2.0 to 17.13.6 and 18.0.0 to 18.2.5 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for joi.
