GitHub Advisoryadvisory · npm

GHSA-wr44-6hxh-3jwq joi messages compilation allows prototype replacement through __proto__ error codes

MEDIUM Published 2026-09-13 Modified 2026-10-05 Official page ↗
Aliases
CVE-2026-90771
Ecosystem
npm
Packages
joi
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Weaknesses
CWE-1321
Reviewed
2026-10-05

Affected packages

• npm joi: < 17.13.8 → fixed in 17.13.8 • npm joi: >= 18.0.0, < 18.2.9 → fixed in 18.2.9

Description

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Related

Alias · CVE (1)

  • CVE-2026-90771 joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts… vulnerability

Weakness · CWE (1)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness

References