CVE-2026-90771

LOW 3.7

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

CVSS Score

3.7

EPSS Score

0.0%

EPSS Percentile

0th

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

CWE	CWE-1321
Vendor	hapijs
Product	joi
Published	Sep 13, 2026

Stay Ahead of the Next One

Get instant alerts for hapijs joi

Be the first to know when new low vulnerabilities affecting hapijs joi are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Affected Versions

hapijs / joi

16.0.0 < 17.13.8 18.0.0 < 18.2.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/hapijs/joi/issues/3150 github.com: https://github.com/hapijs/joi github.com: https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js github.com: https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb vulncheck.com: https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages

Credits

🔍 George Chen