Description
Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request.
Recommendation
Update the joi package to the latest compatible version. Followings are version details:
Affected version(s): **>= 18.0.0, < 18.2.6 >= 17.2.0, < 17.13.7** Patched version(s): **18.2.6 17.13.7**
References
Could your website be exposed too?
SmartScanner can check your website for joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - @hapi/joi - CVE-2026-118772
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - CVE-2026-118772
- markdown-it is has a Regular Expression Denial of Service (ReDoS) - CVE-2026-2327
- steal Inefficient Regular Expression Complexity vulnerability via string variable - CVE-2022-37259
You might also like:
See something that needs correcting? Let us knowUpdated October 05, 2026