{"action":"Upgrade joi to 17.13.7 or later.","affected":[{"fixed":"17.13.7","introduced":"17.2.0"},{"fixed":"18.2.6","introduced":"18.0.0"}],"component":"joi","cve_ids":["CVE-2026-92599"],"ecosystem":"npm","epss":0.00582,"exploited":false,"fixed_versions":["17.13.7","18.2.6"],"ghsa_id":"GHSA-6h2x-m376-mqjq","id":"tcs_01M5KF71Y13Y2FW46SWFHA84B8","modified_at":"2026-10-05T23:45:07.542652334Z","published_at":"2026-09-29T18:07:42Z","references":["https://osv.dev/vulnerability/GHSA-6h2x-m376-mqjq","https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq","https://nvd.nist.gov/vuln/detail/CVE-2026-92599","https://github.com/hapijs/joi/pull/3143","https://github.com/hapijs/joi/pull/3145","https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec","https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245","https://github.com/hapijs/joi","https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-6h2x-m376-mqjq","url":"https://osv.dev/vulnerability/GHSA-6h2x-m376-mqjq"}],"summary":"joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`"}