npm/@hapi/joi CVE-2026-84368: low 3.7, EPSS 0.39%
joi: Prototype pollution via a `__proto__` language key in custom messages
Action: No fix published. Pin and monitor.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 16.0.0 | - | 17.1.1 |
Fixed versions
No fixed version in the source.
Sources
- osv: GHSA-6w3j-5fw6-r9vr#npm/@hapi/joi
- https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
- https://nvd.nist.gov/vuln/detail/CVE-2026-84368
- https://github.com/hapijs/joi/pull/3138
- https://github.com/hapijs/joi/pull/3139
- https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
- https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
- https://github.com/hapijs/joi
CVE-2026-84368 · published · modified · JSON