joi: object().rename() with a template target can set the validated object's prototype

Description

Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern’s own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }).

Recommendation

Update the joi package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 18.0.0, < 18.2.4

  >= 16.0.0, < 17.13.5**

• Patched version(s): **18.2.4

  17.13.5**

References

• GHSA-gg4h-3hg2-grpc
• CVE-2026-84367
• CWE-1321
• CAPEC-310