Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object’s prototype, breaking downstream code relying on Object.prototype methods.
Recommendation
Update the joi package to the latest compatible version. Followings are version details:
Affected version(s): **>= 18.0.0, < 18.2.9 < 17.13.8** Patched version(s): **18.2.9 17.13.8**
References
Could your website be exposed too?
SmartScanner can check your website for joi messages compilation allows prototype replacement through __proto__ error codes and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: Prototype pollution via a `__proto__` language key in custom messages - @hapi/joi - CVE-2026-84368
- joi: Prototype pollution via a `__proto__` language key in custom messages - CVE-2026-84368
- Deep Merge is Vulnerable to Prototype Pollution Through Lack of Sanitization - CVE-2026-6594
- Nuxt dev server arbitrary file read through client error reports - CVE-2026-119198
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026