{"action":"Upgrade joi to 17.13.6 or later.","affected":[{"fixed":"17.13.6","introduced":"17.2.0"},{"fixed":"18.2.5","introduced":"18.0.0"}],"component":"joi","cve_ids":["CVE-2026-84368"],"ecosystem":"npm","epss":0.00389,"exploited":false,"fixed_versions":["17.13.6","18.2.5"],"ghsa_id":"GHSA-6w3j-5fw6-r9vr","id":"tcs_01M5KF835S8MJ16VQ0CEK3C6GT","modified_at":"2026-09-08T21:15:03.964614980Z","published_at":"2026-09-08T20:55:58Z","references":["https://osv.dev/vulnerability/GHSA-6w3j-5fw6-r9vr","https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","https://nvd.nist.gov/vuln/detail/CVE-2026-84368","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","https://github.com/hapijs/joi"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-6w3j-5fw6-r9vr","url":"https://osv.dev/vulnerability/GHSA-6w3j-5fw6-r9vr"}],"summary":"joi: Prototype pollution via a `__proto__` language key in custom messages"}