---
title: "GHSA-q7cg-457f-vx79: joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas"
description: "Moderate severity. joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas. Affects joi; fixed in 18.2.1."
url: https://inlinr.com/advisories/GHSA-q7cg-457f-vx79
lang: en
---

[Packages](https://inlinr.com/packages) / [joi](https://inlinr.com/packages/joi) / [Security](https://inlinr.com/packages/joi/security)

Moderate Vulnerability GHSA-q7cg-457f-vx79 CVE-2026-48038 Published 11 Jun 2026

# joi has an uncaught RangeError on deeply nested input through recursive \`link()\` schemas

Your version 

Affected releases · [joi](https://inlinr.com/packages/joi)

- 18.x 18.0.0 – 18.2.0 Fixed in 18.2.1
- 17.x 17.1.1 – 17.13.3 Fixed in 17.13.4
- 14.x and older 0.0.1 – 14.3.1 No fix, no longer updated

On 18.x, the newest line:

```
npm install joi@18.2.1
```

Every release on a timeline

18.x 

1. Affected

18.0.0 – 18.2.0  
7 releases
2. Fixed

18.2.1 – 18.3.1  
11 releases, latest

17.x 

1. Affected

17.1.1 – 17.13.3  
37 releases
2. Fixed

17.13.4 – 17.13.9  
6 releases

14.x 

1. Affected

14.0.0 – 14.3.1  
12 releases

13.x 

1. Affected

13.0.0 – 13.7.0  
15 releases

12.x 

1. Affected

12.0.0 – 12.1.1  
2 releases

11.x 

1. Affected

11.0.0 – 11.4.0  
12 releases

10.x 

1. Affected

10.0.0 – 10.6.0  
22 releases

9.x 

1. Affected

9.0.0 – 9.2.0  
8 releases

8.x 

1. Affected

8.0.0 – 8.4.2  
14 releases

7.x 

1. Affected

7.0.0 – 7.3.0  
8 releases

6.x 

1. Affected

6.0.0 – 6.10.1  
29 releases

5.x 

1. Affected

5.0.0 – 5.1.0  
4 releases

4.x 

1. Affected

4.0.0 – 4.9.0  
14 releases

3.x 

1. Affected

3.0.0 – 3.1.0  
2 releases

2.x 

1. Affected

2.0.0 – 2.9.0  
17 releases

1.x 

1. Affected

1.0.0 – 1.2.3  
6 releases

0.x 

1. Affected

0.0.1 – 0.4.0  
30 releases

256 stable releases of joi, oldest to newest, one row per major.

## What happens

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. 

The blast radius depends on how the application invokes joi:

- Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process.
- Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References

- Pull request: [hapijs/joi#3113](https://github.com/hapijs/joi/issues/3113)

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: none
- **Availability**: low

CVSS:3.1/​AV:N/​AC:L/​PR:N/​UI:N/​S:U/​C:N/​I:N/​A:L

## References

- [Reference](https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79 "https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79")  
github.com/hapijs/joi/security/advisories/GHSA-…
- [Pull request](https://github.com/hapijs/joi/pull/3113 "https://github.com/hapijs/joi/pull/3113")  
#3113
- [Fix commit](https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11 "https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11")  
2392713
- [Package](https://github.com/hapijs/joi "https://github.com/hapijs/joi")  
github.com/hapijs/joi