Packages / joi / Security

ModerateVulnerabilityGHSA-wr44-6hxh-3jwqCVE-2026-90771Published 13 Sep 2026

joi messages compilation allows prototype replacement through __proto__ error codes

Your version

Affected releases · joi

  • 18.x18.0.0 – 18.2.8Fixed in 18.2.9
  • 17.x17.1.1 – 17.13.7Fixed in 17.13.8
  • 14.x and older0.0.1 – 14.3.1No fix, no longer updated

On 18.x, the newest line:

npm install joi@18.2.9
Every release on a timeline
18.x

  1. Affected

    18.0.0 – 18.2.8

    15 releases

  2. Fixed

    18.2.9 – 18.3.1

    3 releases, latest

17.x

  1. Affected

    17.1.1 – 17.13.7

    41 releases

  2. Fixed

    17.13.8 – 17.13.9

    2 releases

14.x

  1. Affected

    14.0.0 – 14.3.1

    12 releases

13.x

  1. Affected

    13.0.0 – 13.7.0

    15 releases

12.x

  1. Affected

    12.0.0 – 12.1.1

    2 releases

11.x

  1. Affected

    11.0.0 – 11.4.0

    12 releases

10.x

  1. Affected

    10.0.0 – 10.6.0

    22 releases

9.x

  1. Affected

    9.0.0 – 9.2.0

    8 releases

8.x

  1. Affected

    8.0.0 – 8.4.2

    14 releases

7.x

  1. Affected

    7.0.0 – 7.3.0

    8 releases

6.x

  1. Affected

    6.0.0 – 6.10.1

    29 releases

5.x

  1. Affected

    5.0.0 – 5.1.0

    4 releases

4.x

  1. Affected

    4.0.0 – 4.9.0

    14 releases

3.x

  1. Affected

    3.0.0 – 3.1.0

    2 releases

2.x

  1. Affected

    2.0.0 – 2.9.0

    17 releases

1.x

  1. Affected

    1.0.0 – 1.2.3

    6 releases

0.x

  1. Affected

    0.0.1 – 0.4.0

    30 releases

256 stable releases of joi, oldest to newest, one row per major.

What happens

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.