Log in Start free

Vulnerability · Published Sep 1, 2026 · Assigned by GitHub_M

CVE-2026-84367joi: object().rename() with a template target can set the validated object's prototype

Low 3.7

In plain English

A low-severity prototype pollution in joi from hapijs. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-__proto__ with an object value, causing the target to render as __proto__ and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
npmjoi17.13.5GHSA-gg4h-3hg2-grpc
npmjoi18.2.4GHSA-gg4h-3hg2-grpc

Affected products (as reported)

VendorProductVersions
hapijs joi >= 16.0.0, < 17.13.5>= 18.0.0, < 18.2.4

Weakness: CWE-1321 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

References