Description
An application that passes attacker-controlled data into joi’s custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 16.0.0, <= 17.1.1
References
Could your website be exposed too?
SmartScanner can check your website for joi: Prototype pollution via a `__proto__` language key in custom messages - @hapi/joi and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: Prototype pollution via a `__proto__` language key in custom messages - CVE-2026-84368
- Prototype pollution in @feathersjs/commons _.merge via JSON-parsed __proto__ - CVE-2026-54335
- joi messages compilation allows prototype replacement through __proto__ error codes - CVE-2026-90771
- LangSmith Client SDKs has Prototype Pollution in langsmith-sdk via Incomplete `__proto__` Guard in Internal lodash `set( - CVE-2026-40190
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026