CVE-2026-84367

npm/joi CVE-2026-84367: low 3.7, EPSS 0.39%

joi: object().rename() with a template target can set the validated object's prototype

Action: Upgrade joi to 17.13.5 or later.

npm i joi@17.13.5

npm i joi@18.2.4

Affected

Fixed versions

Sources

• osv: GHSA-gg4h-3hg2-grpc
• https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc
• https://nvd.nist.gov/vuln/detail/CVE-2026-84367
• https://github.com/hapijs/joi/pull/3134
• https://github.com/hapijs/joi/pull/3135
• https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6
• https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01
• https://github.com/hapijs/joi
• https://github.com/hapijs/joi/releases/tag/v17.13.5
• https://github.com/hapijs/joi/releases/tag/v18.2.4

CVE-2026-84367 · published 2026-09-08T20:51:21Z · modified 2026-09-08T21:00:05.097709715Z · JSON