---
id: CVE-2026-84368
title: joi is a schema description language and data validator for JavaScript
summary: >-
  joi is a schema description language and data validator for JavaScript. From
  16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the
  successor joi package contain prototype pollution in lib/messages.js, where
  export…
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-1321
vendor: joi
product: joi
affected:
  - 'joi >= 17.2.0, < 17.13.6'
  - '@hapi/joi >= 16.0.0, <= 17.1.1'
  - 'joi >= 18.0.0, < 18.2.5'
patched:
  - joi 17.13.6
  - joi 18.2.5
published: '2026-09-01'
updated: '2026-09-09'
sourceUpdated: '2026-09-09T21:09:13.080'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84368'
references:
  - url: >-
      https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36
    label: security-advisories@github.com
  - url: >-
      https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/pull/3138'
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/pull/3139'
    label: security-advisories@github.com
  - url: 'https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-84368'
  - url: 'https://github.com/advisories/GHSA-6w3j-5fw6-r9vr'
tags:
  - nvd
  - ghsa
  - npm
epss: 0.00389
epssPercentile: 0.30176
aliases:
  - GHSA-6w3j-5fw6-r9vr
ecosystem: npm
ingestedAt: '2026-09-08T21:11:12.321Z'
---

## Overview

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-84368)

Affected packages:

- `joi >= 17.2.0, < 17.13.6`
- `@hapi/joi >= 16.0.0, <= 17.1.1`
- `joi >= 18.0.0, < 18.2.5`

Patched in:

- `joi 17.13.6`
- `joi 18.2.5`

Source: https://github.com/advisories/GHSA-6w3j-5fw6-r9vr