Description
An application that passes attacker-controlled data into joi’s custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them.
Recommendation
Update the joi package to the latest compatible version. Followings are version details:
Affected version(s): **>= 18.0.0, < 18.2.5 >= 17.2.0, < 17.13.6** Patched version(s): **18.2.5 17.13.6**
References
Could your website be exposed too?
SmartScanner can check your website for joi: Prototype pollution via a `__proto__` language key in custom messages and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: Prototype pollution via a `__proto__` language key in custom messages - @hapi/joi - CVE-2026-84368
- Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ - CVE-2026-54335
- joi messages compilation allows prototype replacement through __proto__ error codes - CVE-2026-90771
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026