CVE-2026-48038Medium· 5.3▾ Sunlitjoi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 15.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
0.3%
0.3% → 0.5%
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.Upgrade to version >= 18.2.1.
Try/catch the validation to avoid uncaught exceptions.
joi >= 18.0.0, < 18.2.1joi < 17.13.4Upgrade to a patched release:
joi 18.2.1joi 17.13.4Connected by shared product, vendor, weakness, or advisory.
CVE-2026-84367Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-84368Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-92599High· 7.5joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule
CVE-2026-90771Low· 3.7joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code
CVE-2026-48069High· 7.5@grpc/grpc-js: An incoming malformed compressed message can cause a client or server crash
CVE-2026-65410High· 7.5The issue was addressed with improved checks