---
title: "@hapi/joi 17.1.1"
description: "@hapi/joi is deprecated on npm. Switch to 'npm install joi'"
url: https://inlinr.com/packages/@hapi/joi
lang: en
---

[Packages](https://inlinr.com/packages)

# @hapi/joi

17.1.1 · 14 Mar 2020 BSD-3-Clause 2.1M / week [Repository](https://github.com/hapijs/joi) [Homepage](https://github.com/hapijs/joi#readme) [npm](https://www.npmjs.com/package/@hapi/joi) [Atom feed](https://inlinr.com/packages/feed/@hapi/joi)

Deprecated by its maintainers: Switch to 'npm install joi' [What to use instead](https://inlinr.com/packages/@hapi/joi#alternatives)

Your version 

## Where each line stands

[Plan an upgrade](https://inlinr.com/packages/@hapi/joi/upgrade)

LineNewestSecurity

- 17.x 17.1.1 2 open advisories, worst high Latest line
- 16.x 16.1.8 2 open advisories, worst high  · last release Nov 2019, no longer updated [To 17.1.1](https://inlinr.com/packages/@hapi/joi/upgrade/16.1.8-17.1.1)
- 15.x 15.1.1 No known advisory [To 17.1.1](https://inlinr.com/packages/@hapi/joi/upgrade/15.1.1-17.1.1)
- 14.x 14.5.0 No known advisory [To 17.1.1](https://inlinr.com/packages/@hapi/joi/upgrade/14.5.0-17.1.1)

## What to use instead

Its maintainers name no replacement, and the e18e list has none yet.

## Latest releases

[All 25 releases](https://inlinr.com/packages/@hapi/joi/releases)

1. 17.x · latest line
2. ### [17.1.1](https://inlinr.com/packages/@hapi/joi/releases/17.1.1 "Open this release")  
14 Mar 2020
3. ### [17.1.0](https://inlinr.com/packages/@hapi/joi/releases/17.1.0 "Open this release")  
20 Jan 2020
4. ### [17.0.2](https://inlinr.com/packages/@hapi/joi/releases/17.0.2 "Open this release")  
9 Jan 2020

Notes older than 90 days are read on the [Releases tab](https://inlinr.com/packages/@hapi/joi/releases).

Dependency tracking · free for 3 projects

## Know when your own dependencies move

@hapi/joi had 2 security advisories in the last 12 months. inlinr emails you the day one touches a project of yours, with the version that fixes it.

- Advisories reach you  
An email when a critical or high advisory affects a project, before the next install.
- Upgrades checked first  
Peer ranges, Node, ESM-only and types changes read before you bump.
- Only what matters  
Majors and breaking notes stay; patches and sibling bumps fold into one line.

[How dependency tracking works](https://inlinr.com/dependencies)

## Security

[Details](https://inlinr.com/packages/@hapi/joi/security)

- [joi: quadratic-time split in \`string().email({ multiple: true })\` allows denial of service](https://inlinr.com/advisories/GHSA-4528-x5fx-h6hg) High · no fix on 17.x yet
- [joi: Prototype pollution via a \`\_\_proto\_\_\` language key in custom messages](https://inlinr.com/advisories/GHSA-6w3j-5fw6-r9vr) Low · no fix on 17.x yet

## Health

[Details](https://inlinr.com/packages/@hapi/joi/security#signals)

- **Provenance**:
- **Publisher**:
- **Maintainers**:
- **Scorecard**:
- **Size**:

## Weekly downloads

## Same family

- [joi 34.3M/wk](https://inlinr.com/packages/joi)
- [@hapi/bourne 6.9M/wk](https://inlinr.com/packages/@hapi/bourne)

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.