CVE-2026-92599
1 advisory.
npm/joi CVE-2026-92599: high 7.5
joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
Action: Upgrade joi to 17.13.7 or later.
npm i joi@17.13.7npm i joi@18.2.6Affected
| introduced | fixed | last affected |
|---|---|---|
| 17.2.0 | 17.13.7 | - |
| 18.0.0 | 18.2.6 | - |
Fixed versions
| 17.13.7 | 18.2.6 |
Sources
- osv: GHSA-6h2x-m376-mqjq
- https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
- https://nvd.nist.gov/vuln/detail/CVE-2026-92599
- https://github.com/hapijs/joi/pull/3143
- https://github.com/hapijs/joi/pull/3145
- https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec
- https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245
- https://github.com/hapijs/joi
- https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate
CVE-2026-92599 · published · modified · JSON