Packages / joi / Security

ModerateVulnerabilityGHSA-q7cg-457f-vx79CVE-2026-48038Published 11 Jun 2026

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

Your version

Affected releases · joi

  • 18.x18.0.0 – 18.2.0Fixed in 18.2.1
  • 17.x17.1.1 – 17.13.3Fixed in 17.13.4
  • 14.x and older0.0.1 – 14.3.1No fix, no longer updated

On 18.x, the newest line:

npm install joi@18.2.1
Every release on a timeline
18.x

  1. Affected

    18.0.0 – 18.2.0

    7 releases

  2. Fixed

    18.2.1 – 18.3.1

    11 releases, latest

17.x

  1. Affected

    17.1.1 – 17.13.3

    37 releases

  2. Fixed

    17.13.4 – 17.13.9

    6 releases

14.x

  1. Affected

    14.0.0 – 14.3.1

    12 releases

13.x

  1. Affected

    13.0.0 – 13.7.0

    15 releases

12.x

  1. Affected

    12.0.0 – 12.1.1

    2 releases

11.x

  1. Affected

    11.0.0 – 11.4.0

    12 releases

10.x

  1. Affected

    10.0.0 – 10.6.0

    22 releases

9.x

  1. Affected

    9.0.0 – 9.2.0

    8 releases

8.x

  1. Affected

    8.0.0 – 8.4.2

    14 releases

7.x

  1. Affected

    7.0.0 – 7.3.0

    8 releases

6.x

  1. Affected

    6.0.0 – 6.10.1

    29 releases

5.x

  1. Affected

    5.0.0 – 5.1.0

    4 releases

4.x

  1. Affected

    4.0.0 – 4.9.0

    14 releases

3.x

  1. Affected

    3.0.0 – 3.1.0

    2 releases

2.x

  1. Affected

    2.0.0 – 2.9.0

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    6 releases

0.x

  1. Affected

    0.0.1 – 0.4.0

    30 releases

256 stable releases of joi, oldest to newest, one row per major.

What happens

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

  • Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.

  • Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References