Description
Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.
Recommendation
No fix is available yet. Followings are affected versions:
- >= 16.0.0, <= 17.1.1
References
Could your website be exposed too?
SmartScanner can check your website for joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - @hapi/joi and gives you actionable findings to investigate.
Start a free scanRelated Issues
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service - CVE-2026-118772
- @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service - CVE-2026-119202
- markdown-it: Quadratic-time denial of service in inline HTML parsing with html enabled - CVE-2026-111766
- path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867
You might also like:
See something that needs correcting? Let us knowUpdated October 30, 2026