---
title: "GHSA-wr44-6hxh-3jwq: joi messages compilation allows prototype replacement through __proto__ error codes"
description: "Moderate severity. joi messages compilation allows prototype replacement through __proto__ error codes. Affects joi; fixed in 18.2.9."
url: https://inlinr.com/advisories/GHSA-wr44-6hxh-3jwq
lang: en
---

[Packages](https://inlinr.com/packages) / [joi](https://inlinr.com/packages/joi) / [Security](https://inlinr.com/packages/joi/security)

Moderate Vulnerability GHSA-wr44-6hxh-3jwq CVE-2026-90771 Published 13 Sep 2026

# joi messages compilation allows prototype replacement through \_\_proto\_\_ error codes

Your version 

Affected releases · [joi](https://inlinr.com/packages/joi)

- 18.x 18.0.0 – 18.2.8 Fixed in 18.2.9
- 17.x 17.1.1 – 17.13.7 Fixed in 17.13.8
- 14.x and older 0.0.1 – 14.3.1 No fix, no longer updated

On 18.x, the newest line:

```
npm install joi@18.2.9
```

Every release on a timeline

18.x 

1. Affected

18.0.0 – 18.2.8  
15 releases
2. Fixed

18.2.9 – 18.3.1  
3 releases, latest

17.x 

1. Affected

17.1.1 – 17.13.7  
41 releases
2. Fixed

17.13.8 – 17.13.9  
2 releases

14.x 

1. Affected

14.0.0 – 14.3.1  
12 releases

13.x 

1. Affected

13.0.0 – 13.7.0  
15 releases

12.x 

1. Affected

12.0.0 – 12.1.1  
2 releases

11.x 

1. Affected

11.0.0 – 11.4.0  
12 releases

10.x 

1. Affected

10.0.0 – 10.6.0  
22 releases

9.x 

1. Affected

9.0.0 – 9.2.0  
8 releases

8.x 

1. Affected

8.0.0 – 8.4.2  
14 releases

7.x 

1. Affected

7.0.0 – 7.3.0  
8 releases

6.x 

1. Affected

6.0.0 – 6.10.1  
29 releases

5.x 

1. Affected

5.0.0 – 5.1.0  
4 releases

4.x 

1. Affected

4.0.0 – 4.9.0  
14 releases

3.x 

1. Affected

3.0.0 – 3.1.0  
2 releases

2.x 

1. Affected

2.0.0 – 2.9.0  
17 releases

1.x 

1. Affected

1.0.0 – 1.2.3  
6 releases

0.x 

1. Affected

0.0.1 – 0.4.0  
30 releases

256 stable releases of joi, oldest to newest, one row per major.

## What happens

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts **proto** as an error code. Attackers can supply **proto** keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

## How it is exploited

Exploitable over the network, with no account and no action from a user.

- **Confidentiality**: none
- **Integrity**: low
- **Availability**: none

CVSS:3.1/​AV:N/​AC:H/​PR:N/​UI:N/​S:U/​C:N/​I:L/​A:N

## References

- [NVD](https://nvd.nist.gov/vuln/detail/CVE-2026-90771 "https://nvd.nist.gov/vuln/detail/CVE-2026-90771")  
nvd.nist.gov/vuln/detail/CVE-2026-90771
- [Issue](https://github.com/hapijs/joi/issues/3150 "https://github.com/hapijs/joi/issues/3150")  
#3150
- [Pull request](https://github.com/hapijs/joi/pull/3151 "https://github.com/hapijs/joi/pull/3151")  
#3151
- [Pull request](https://github.com/hapijs/joi/pull/3153 "https://github.com/hapijs/joi/pull/3153")  
#3153
- [Fix commit](https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2 "https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2")  
1d2001c
- [Fix commit](https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb "https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb")  
5b8333c
- [Package](https://github.com/hapijs/joi "https://github.com/hapijs/joi")  
github.com/hapijs/joi
- [Reference](https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js "https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js")  
github.com/hapijs/joi/blob/v18.2.8/lib/messages…
- [Reference](https://github.com/hapijs/joi/releases/tag/v17.13.8 "https://github.com/hapijs/joi/releases/tag/v17.13.8")  
github.com/hapijs/joi/releases/tag/v17.13.8
- [Reference](https://github.com/hapijs/joi/releases/tag/v18.2.9 "https://github.com/hapijs/joi/releases/tag/v18.2.9")  
github.com/hapijs/joi/releases/tag/v18.2.9
- [Reference](https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages "https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages")  
vulncheck.com/advisories/joi-before-17.13.8-and…