Description
Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.
Recommendation
Update the joi package to the latest compatible version. Followings are version details:
Affected version(s): **>= 18.0.0, < 18.3.1 >= 17.1.1, < 17.13.9** Patched version(s): **18.3.1 17.13.9**
References
Could your website be exposed too?
SmartScanner can check your website for joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - @hapi/joi - CVE-2026-118772
- @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service - CVE-2026-119202
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026