CVE-2026-90771mediumCWE-1321

CVE-2026-90771: falha de média gravidade em hapijs joi

joi before 17.13.8 and 18.2.9 Prototype Pollution via messages

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar joi+ Monitorar joi

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.3epss 0.4%
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
hapijs · joi
CVEs relacionadas — hapijs joi

No mesmo produto, das mais perigosas para as menos.

CVE-2026-92599HIGHJoi before 17.13.7 and 18.2.6 ReDoS via isoDateEPSS 0.6%CVE-2026-48038MEDIUMjoi: Uncaught RangeError on deeply nested input through recursive `link()` schemasEPSS 0.5%CVE-2026-118772HIGHjoi: quadratic-time split in `string().email({ multiple: true })` allows denial of serviceEPSS 0.5%CVE-2026-84368LOWjoi: Prototype pollution via a `__proto__` language key in custom messagesEPSS 0.4%CVE-2026-84367LOWjoi: object().rename() with a template target can set the validated object's prototypeEPSS 0.4%CVE-2026-122131MEDIUMJoi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language KeyEPSS 0.3%