---
id: CVE-2026-48038
aliases:
  - GHSA-q7cg-457f-vx79
title: >-
  joi has an uncaught RangeError on deeply nested input through recursive
  `link()` schemas
summary: >-
  joi has an uncaught RangeError on deeply nested input through recursive
  `link()` schemas
severity: medium
cvss: 5.3
cwe:
  - CWE-248
  - CWE-400
vendor: joi
product: joi
ecosystem: npm
affected:
  - 'joi >= 18.0.0, < 18.2.1'
  - joi < 17.13.4
patched:
  - joi 18.2.1
  - joi 17.13.4
published: '2026-06-11'
updated: '2026-06-12'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-q7cg-457f-vx79'
references:
  - url: 'https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79'
  - url: 'https://github.com/hapijs/joi/pull/3113'
  - url: >-
      https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
  - url: 'https://github.com/advisories/GHSA-q7cg-457f-vx79'
tags:
  - ghsa
  - npm
ingestedAt: '2026-07-07T15:41:59.319Z'
epss: 0.00524
epssPercentile: 0.42001
---

## Overview

### Impact
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. 

The blast radius depends on how the application invokes joi:
- Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process.
- Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.

### Patches
Upgrade to version >= 18.2.1.

### Workarounds
Try/catch the validation to avoid uncaught exceptions.

### References
- Pull request: hapijs/joi#3113

## Affected packages

- `joi >= 18.0.0, < 18.2.1`
- `joi < 17.13.4`

## Remediation

Upgrade to a patched release:

- `joi 18.2.1`
- `joi 17.13.4`