---
title: "GHSA-gg4h-3hg2-grpc: joi: object().rename() with a template target can set the validated object's prototype"
description: "Low severity. joi: object().rename() with a template target can set the validated object's prototype. Affects joi; fixed in 18.2.4."
url: https://inlinr.com/advisories/GHSA-gg4h-3hg2-grpc
lang: en
---

[Packages](https://inlinr.com/packages) / [joi](https://inlinr.com/packages/joi) / [Security](https://inlinr.com/packages/joi/security)

Low Vulnerability GHSA-gg4h-3hg2-grpc CVE-2026-84367 Published 8 Sep 2026

# joi: object().rename() with a template target can set the validated object's prototype

Your version 

Affected releases · [joi](https://inlinr.com/packages/joi)

- 18.x 18.0.0 – 18.2.3 Fixed in 18.2.4
- 17.x 17.1.1 – 17.13.4 Fixed in 17.13.5

On 18.x, the newest line:

```
npm install joi@18.2.4
```

Every release on a timeline

18.x 

1. Affected

18.0.0 – 18.2.3  
10 releases
2. Fixed

18.2.4 – 18.3.1  
8 releases, latest

17.x 

1. Affected

17.1.1 – 17.13.4  
38 releases
2. Fixed

17.13.5 – 17.13.9  
5 releases

256 stable releases of joi, oldest to newest, one row per major.

## What happens

Impact

Applications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern's own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.

Schemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.

Patches

Versions 17.13.5 and 18.2.4 have been released to address the issue.

Workarounds

1. Replace the template rename target with a static string target.
2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true })`
3. Drop { multiple: true } from the rename, which stops the rename before the assignment.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:L/​A:N

## References

- [Reference](https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc "https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc")  
github.com/hapijs/joi/security/advisories/GHSA-…
- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-84367 "https://nvd.nist.gov/vuln/detail/CVE-2026-84367")  
nvd.nist.gov/vuln/detail/CVE-2026-84367
- [Pull request](https://github.com/hapijs/joi/pull/3134 "https://github.com/hapijs/joi/pull/3134")  
#3134
- [Pull request](https://github.com/hapijs/joi/pull/3135 "https://github.com/hapijs/joi/pull/3135")  
#3135
- [Fix commit](https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6 "https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6")  
162f367
- [Fix commit](https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01 "https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01")  
172ecec
- [Package](https://github.com/hapijs/joi "https://github.com/hapijs/joi")  
github.com/hapijs/joi
- [Reference](https://github.com/hapijs/joi/releases/tag/v17.13.5 "https://github.com/hapijs/joi/releases/tag/v17.13.5")  
github.com/hapijs/joi/releases/tag/v17.13.5
- [Reference](https://github.com/hapijs/joi/releases/tag/v18.2.4 "https://github.com/hapijs/joi/releases/tag/v18.2.4")  
github.com/hapijs/joi/releases/tag/v18.2.4