joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

Description

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.

Recommendation

Update the joi package to the latest compatible version. Followings are version details:

• Affected version(s): **< 17.13.4

  >= 18.0.0, < 18.2.1**

• Patched version(s): **17.13.4

  18.2.1**

References

• GHSA-q7cg-457f-vx79
• CVE-2026-48038
• CWE-248
• CWE-400
• CAPEC-310
• OWASP 2021-A6

Related Issues

• @nocobase/database has SQL Injection via String Concatenation through Recursive Eager Loading - CVE-2026-41640
• Electerm users can run dangrous code through link or command line - CVE-2026-43944
• RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
• jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method - CVE-2026-25755

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

joi