npm/joi CVE-2026-84368: low 3.7, EPSS 0.39%
joi: Prototype pollution via a `__proto__` language key in custom messages
Action: Upgrade joi to 17.13.6 or later.
npm i joi@17.13.6npm i joi@18.2.5Affected
| introduced | fixed | last affected |
|---|---|---|
| 17.2.0 | 17.13.6 | - |
| 18.0.0 | 18.2.5 | - |
Fixed versions
| 17.13.6 | 18.2.5 |
Sources
- osv: GHSA-6w3j-5fw6-r9vr
- https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
- https://nvd.nist.gov/vuln/detail/CVE-2026-84368
- https://github.com/hapijs/joi/pull/3138
- https://github.com/hapijs/joi/pull/3139
- https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
- https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
- https://github.com/hapijs/joi
CVE-2026-84368 · published · modified · JSON