Description

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.7",
  "pubDate": "2026-09-13T11:17:01.613Z",
  "pubdate": "2026-09-13T11:17:01.613Z",
  "executiveSummary": "Joi versions prior to 17.13.8 and 18.2.9 are susceptible to a prototype pollution vulnerability residing within the messages compilation function.\nThe flaw allows an attacker to inject arbitrary properties into the global Object prototype by passing a '__proto__' key within a custom error message configuration.\nSuccessful exploitation enables an attacker to modify the behavior of standard JavaScript objects, which may lead to denial-of-service, unintended execution logic, or bypass of security checks in downstream components that rely on default Object.prototype methods.\nThis vulnerability is particularly critical for applications that dynamically handle user-supplied error configurations or schemas, potentially allowing remote attackers to manipulate the application state without requiring high-level authentication.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper sanitization of keys during the message compilation process within the Joi library. When custom error messages are defined, the library fails to validate or block the use of '__proto__', a special key in JavaScript that accesses the prototype of an object.\nBy supplying a specially crafted object where the key is set to '__proto__', the Joi compilation function inadvertently merges this key into the underlying object structure. Because JavaScript objects share the same Object.prototype, mutating this prototype propagates the changes to all objects within the runtime environment.\nThe attack flow proceeds as follows: 1) An attacker identifies an input vector where user-supplied data is passed to a Joi schema's message configuration; 2) The attacker submits a malicious object containing a '__proto__' property; 3) The Joi message compilation function processes the object and assigns the key/value pair to the prototype chain; 4) The application environment is effectively polluted, causing subsequent object operations that rely on standard prototype methods (such as toString, hasOwnProperty, or constructor) to behave according to the attacker's injected values.\nThis behavior facilitates a wide range of post-exploitation impacts. By overriding core prototype methods, an attacker can disrupt the logical flow of the application, cause crashes (Denial of Service), or potentially achieve remote code execution if the application logic executes properties derived from the modified prototype. The vulnerability does not require authentication to trigger if the vulnerable endpoint is exposed to user input. The impact is persistent for the lifetime of the process, making it a critical risk for server-side Node.js applications that manage long-running execution contexts."
}