Description
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
- Highest impact:
validate()called withouttry/catchin a request handler would cause an unhandled exception, potentially crashing the process.
Recommendation
Update the joi package to the latest compatible version. Followings are version details:
Affected version(s): **< 17.13.4 >= 18.0.0, < 18.2.1** Patched version(s): **17.13.4 18.2.1**
References
Could your website be exposed too?
SmartScanner can check your website for joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
- Electerm users can run dangrous code through link or command line - CVE-2026-43944
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
- jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755
You might also like:
See something that needs correcting? Let us knowUpdated June 12, 2026