GHSA-6h2x-m376-mqjqHigh· 7.5▾ Twilightjoi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s.
Upgrade to version 17.13.7 or 18.2.6 depending on your current major version.
None except capping the length of the string before it reaches joi.
joi >= 17.2.0, < 17.13.7joi >= 18.0.0, < 18.2.6Upgrade to a patched release:
joi 17.13.7joi 18.2.6Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92599High· 7.5joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule
CVE-2026-84367Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-84368Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-48038Medium· 5.3joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
CVE-2026-90771Low· 3.7joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code
CVE-2024-21538High· 7.5Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are vulnerable to Regular Expression Denial of Service (ReDoS) due to improper input sanitization