joi
18.3.1 · 28 Oct 2026BSD-3-Clause34.7M / weekRepositoryHomepagenpmAtom feed
Your version
17.13.4
12 Jun 202617.13.9 is the newest release of 17.x.
Security
Fixes 1 advisory that affected 17.13.3
- Moderatejoi has an uncaught RangeError on deeply nested input through recursive `link()` schemasGHSA-q7cg-457f-vx79 · 11 Jun 2026Fixed in 17.13.4
4 advisories affect 17.13.4; 17.13.8 fixes them
- Highjoi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`GHSA-6h2x-m376-mqjq · 29 Sep 2026Fixed in 17.13.7
- Moderatejoi messages compilation allows prototype replacement through __proto__ error codesGHSA-wr44-6hxh-3jwq · 13 Sep 2026Fixed in 17.13.8
- Lowjoi: Prototype pollution via a `__proto__` language key in custom messagesGHSA-6w3j-5fw6-r9vr · 8 Sep 2026Fixed in 17.13.6
- Lowjoi: object().rename() with a template target can set the validated object's prototypeGHSA-gg4h-3hg2-grpc · 8 Sep 2026Fixed in 17.13.5
Release note
No note was found for 17.13.4 on GitHub or in the repository's changelog.