---
id: CVE-2026-84367
title: joi is a schema description language and data validator for JavaScript
summary: >-
  joi is a schema description language and data validator for JavaScript. From
  16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename()
  implementation used by object().rename() permits a schema that renames keys
  with a r…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-1321
vendor: joi
product: joi
affected:
  - 'joi >= 16.0.0, < 17.13.5'
  - 'joi >= 18.0.0, < 18.2.4'
patched:
  - joi 17.13.5
  - joi 18.2.4
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84367'
references:
  - url: >-
      https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6
    label: security-advisories@github.com
  - url: >-
      https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/pull/3134'
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/pull/3135'
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84367'
  - url: 'https://github.com/hapijs/joi/releases/tag/v17.13.5'
  - url: 'https://github.com/hapijs/joi/releases/tag/v18.2.4'
  - url: 'https://github.com/advisories/GHSA-gg4h-3hg2-grpc'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.0027
epssPercentile: 0.19426
aliases:
  - GHSA-gg4h-3hg2-grpc
ecosystem: npm
ingestedAt: '2026-09-08T21:11:12.322Z'
---

## Overview

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84367)

Affected packages:

- `joi >= 16.0.0, < 17.13.5`
- `joi >= 18.0.0, < 18.2.4`

Patched in:

- `joi 17.13.5`
- `joi 18.2.4`

Source: https://github.com/advisories/GHSA-gg4h-3hg2-grpc