GHSA-4528-x5fx-h6hg joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

• npm joi: >= 17.1.1, < 17.13.9 → fixed in 17.13.9 • npm @hapi/joi: >= 16.0.0, <= 17.1.1 (no fix yet) • npm joi: >= 18.0.0, < 18.3.1 → fixed in 18.3.1

Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: ```js const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`); // ... const emails = options.multiple ? value.split(regex) : [value]; ``` `String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values. The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear: ```js const regex = new RegExp(`(?:(?"} ``` Impact This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with `Joi.string().email({ multiple: true })` and that has no length limit before the `email` rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.