CVE-2026-48038
1 advisory.
npm/joi CVE-2026-48038: medium 5.3, EPSS 0.52%
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
Action: Upgrade joi to 17.13.4 or later.
npm i joi@18.2.1npm i joi@17.13.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 18.0.0 | 18.2.1 | - |
| 0 | 17.13.4 | - |
Fixed versions
| 18.2.1 | 17.13.4 |
Sources
- osv: GHSA-q7cg-457f-vx79
- https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79
- https://github.com/hapijs/joi/pull/3113
- https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
- https://github.com/hapijs/joi
CVE-2026-48038 · published · modified · JSON