hapijs joi

• CVE-2026-122131 Low 3.7 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key 0.3%
• CVE-2026-118772 High 7.5 joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service 0.5%
• CVE-2026-92599 High 7.5 Joi before 17.13.7 and 18.2.6 ReDoS via isoDate 0.6%
• CVE-2026-90771 Low 3.7 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages 0.4%
• CVE-2026-84368 Low 3.7 joi: Prototype pollution via a `__proto__` language key in custom messages 0.4%
• CVE-2026-84367 Low 3.7 joi: object().rename() with a template target can set the validated object's prototype 0.4%
• CVE-2026-48038 Medium 5.3 joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas 0.5%