{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"16.0.0","last_affected":"17.1.1"}],"component":"@hapi/joi","cve_ids":["CVE-2026-84368"],"ecosystem":"npm","epss":0.00389,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-6w3j-5fw6-r9vr","id":"tcs_01M5KF83CHPHBV1G774PBF538X","modified_at":"2026-09-08T21:15:03.964614980Z","published_at":"2026-09-08T20:55:58Z","references":["https://osv.dev/vulnerability/GHSA-6w3j-5fw6-r9vr","https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","https://nvd.nist.gov/vuln/detail/CVE-2026-84368","https://github.com/hapijs/joi/pull/3138","https://github.com/hapijs/joi/pull/3139","https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","https://github.com/hapijs/joi"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-6w3j-5fw6-r9vr#npm/@hapi/joi","url":"https://osv.dev/vulnerability/GHSA-6w3j-5fw6-r9vr"}],"summary":"joi: Prototype pollution via a `__proto__` language key in custom messages"}