---
title: "GHSA-4528-x5fx-h6hg: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service"
description: "High severity. joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service. Affects @hapi/joi, joi."
url: https://inlinr.com/advisories/GHSA-4528-x5fx-h6hg
lang: en
---

[Packages](https://inlinr.com/packages)

High Vulnerability GHSA-4528-x5fx-h6hg CVE-2026-118772 Published 30 Oct 2026

# joi: quadratic-time split in \`string().email({ multiple: true })\` allows denial of service

Your version of @hapi/joi 

Affected releases · [@hapi/joi](https://inlinr.com/packages/@hapi/joi)

- 17.x 17.0.0 – 17.1.1 No fix on this line yet
- 16.x 16.0.0 – 16.1.8 No fix on this line yet

No release fixes it yet, not even the latest, 17.1.1.

Every release on a timeline

17.x 

1. Affected

17.0.0 – 17.1.1  
5 releases, latest

16.x 

1. Affected

16.0.0 – 16.1.8  
11 releases

25 stable releases of @hapi/joi, oldest to newest, one row per major.

Your version of joi 

Affected releases · [joi](https://inlinr.com/packages/joi)

- 18.x 18.0.0 – 18.3.0 Fixed in 18.3.1
- 17.x 17.1.1 – 17.13.8 Fixed in 17.13.9

On 18.x, the newest line:

```
npm install joi@18.3.1
```

Every release on a timeline

18.x 

1. Affected

18.0.0 – 18.3.0  
17 releases
2. Fixed

18.3.1 – 18.3.2  
2 releases, latest

17.x 

1. Affected

17.1.1 – 17.13.8  
42 releases
2. Fixed

17.13.9  
1 release

257 stable releases of joi, oldest to newest, one row per major.

## What happens

Summary

`Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

Details

When the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

```
const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);
// ...
const emails = options.multiple ? value.split(regex) : [value];
```

`String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values.

The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

```
const regex = new RegExp(`(?:(?<!\\s)\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);
```

The split results do not change. The regular expression is now built only when `multiple` is set.

Every `joi` release from `17.1.1` up to and including `17.13.8`, and from `18.0.0` up to and including `18.3.0`, is affected. Every [@hapi/joi](https://inlinr.com/packages/@hapi/joi) release from `16.0.0` is affected.

Workarounds for users who cannot upgrade:

- Add `.max()` before `.email()`, for example `Joi.string().max(1000).email({ multiple: true })`. The `max` rule then rejects long values before the `email` rule runs.
- Do not use the `abortEarly: false` option with this schema. With `abortEarly: false`, the `email` rule runs even when the `max` rule fails.
- Do not use `.trim()` as a workaround. It removes only the whitespace at the start and at the end of the value.

Proof of concept

```
const Joi = require('joi');

const schema = Joi.string().email({ multiple: true });
for (const n of [25000, 50000, 100000, 200000]) {
    const start = Date.now();
    schema.validate(' '.repeat(n));
    console.log(`${n} spaces: ${Date.now() - start} ms`);
}
```

Output on `joi@18.3.0` (Node.js 26):

```
25000 spaces: 244 ms
50000 spaces: 887 ms
100000 spaces: 3349 ms
200000 spaces: 13579 ms
```

Output on the patched version:

```
25000 spaces: 0 ms
50000 spaces: 0 ms
100000 spaces: 0 ms
200000 spaces: 1 ms
```

Over HTTP, send the whitespace in a field that the route validates with this schema:

```
POST /invite HTTP/1.1
Content-Type: application/json

{"emails": "<100000 spaces>"}
```

Impact

This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with `Joi.string().email({ multiple: true })` and that has no length limit before the `email` rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: high

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:H

## References

- [Reference](https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg "https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg")  
github.com/hapijs/joi/security/advisories/GHSA-…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-118772 "https://nvd.nist.gov/vuln/detail/CVE-2026-118772")  
nvd.nist.gov/vuln/detail/CVE-2026-118772
- [Pull request](https://github.com/hapijs/joi/pull/3162 "https://github.com/hapijs/joi/pull/3162")  
#3162
- [Pull request](https://github.com/hapijs/joi/pull/3163 "https://github.com/hapijs/joi/pull/3163")  
#3163
- [Fix commit](https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf "https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf")  
03dc1d9
- [Fix commit](https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e "https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e")  
807858d
- [Package](https://github.com/hapijs/joi "https://github.com/hapijs/joi")  
github.com/hapijs/joi
- [Reference](https://github.com/hapijs/joi/releases/tag/v17.13.9 "https://github.com/hapijs/joi/releases/tag/v17.13.9")  
github.com/hapijs/joi/releases/tag/v17.13.9
- [Reference](https://github.com/hapijs/joi/releases/tag/v18.3.1 "https://github.com/hapijs/joi/releases/tag/v18.3.1")  
github.com/hapijs/joi/releases/tag/v18.3.1