CVE-2026-90771: joi Prototype Pollution via __proto__ Error Codes
Summary
CVE-2026-90771: joi messages compilation allows prototype replacement through proto error codes. Affects joi across 2 version ranges.
< 17.13.8
>= 18.0.0, < 18.2.9
Fixed in 17.13.8 or 18.2.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
joi is a popular JavaScript library used for schema validation, allowing developers to define and validate object structures easily. It provides a powerful and flexible way to ensure that data conforms to expected formats, making it widely adopted in Node.js applications. However, certain versions of joi are vulnerable to a prototype pollution issue that can compromise application security.
Vulnerability Detail
The vulnerability arises from the messages compilation function in joi, which improperly handles error codes that include proto. This allows attackers to inject proto keys in custom messages, leading to prototype pollution. As a result, the prototype of objects returned by joi can be altered, potentially breaking downstream code that relies on standard Object.prototype methods. This can lead to unexpected behavior and security issues in applications that utilize joi for validation.
How To Fix
Latest published version: 18.3.0 as of 23 Oct 2026
npm install joi@18.3.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 17.13.817.13.8npm install joi@17.13.8 -
>= 18.0.0, < 18.2.918.2.9npm install joi@18.2.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you cannot immediately update the joi package, consider reviewing and sanitizing any custom error messages to ensure they do not include proto keys. This can help mitigate the risk of prototype pollution until an update can be applied.
Conclusion
The joi library has a prototype pollution vulnerability that can be exploited through custom error messages. It is crucial to update to the patched versions to secure your applications. Additionally, consider using tools like Vulert to monitor for vulnerabilities in your dependencies.
See every vulnerability recorded for joi →
FAQ
Prototype pollution is a security vulnerability that allows an attacker to modify the prototype of built-in objects in JavaScript, potentially leading to unexpected behavior in applications.
Versions of joi prior to 17.13.8 and 18.2.9 are affected by this prototype pollution vulnerability.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in your software. By analyzing your package-lock.json file, Vulert can help identify if your application is affected by this vulnerability.
If an immediate update is not possible, review and sanitize any custom error messages to avoid including proto keys, which can help mitigate the risk until an update is applied.
The CVSS score for this vulnerability is 3.7, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for joi.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
