---
title: "@hapi/joi security advisories"
description: "2 known security advisories for @hapi/joi, with the versions they affect and the version that fixes each."
url: https://inlinr.com/packages/@hapi/joi/security
lang: en
---

[Packages](https://inlinr.com/packages)

# @hapi/joi

17.1.1 · 14 Mar 2020 BSD-3-Clause 2.1M / week [Repository](https://github.com/hapijs/joi) [Homepage](https://github.com/hapijs/joi#readme) [npm](https://www.npmjs.com/package/@hapi/joi) [Atom feed](https://inlinr.com/packages/feed/@hapi/joi)

Deprecated by its maintainers: Switch to 'npm install joi' [What to use instead](https://inlinr.com/packages/@hapi/joi#alternatives)

Your version 

## Security advisories

From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.

| Line | Newest | Where it stands                                                           |
| ---- | ------ | ------------------------------------------------------------------------- |
|      | 17.1.1 | 2 open advisories, worst high                                             |
|      | 16.1.8 | 2 open advisories, worst high  · last release Nov 2019, no longer updated |

- High  
[joi: quadratic-time split in \`string().email({ multiple: true })\` allows denial of service](https://inlinr.com/advisories/GHSA-4528-x5fx-h6hg)GHSA-4528-x5fx-h6hg · 30 Oct 2026  
no fix on 17.x yet
- Low  
[joi: Prototype pollution via a \`\_\_proto\_\_\` language key in custom messages](https://inlinr.com/advisories/GHSA-6w3j-5fw6-r9vr)GHSA-6w3j-5fw6-r9vr · 8 Sep 2026  
no fix on 17.x yet

### Quality and security signals

What [npm](https://www.npmjs.com/package/@hapi/joi) and [deps.dev](https://deps.dev/npm/%40hapi%2Fjoi) say about the latest release. Signals, not a verdict.

Reading npm and deps.dev…

Registry facts last checked 4 Nov 2026\. Releases and advisories last read 4 Nov 2026.