---
id: "CVE-2026-118772"
kind: "vulnerability"
aliases: ["CVE-2026-118772"]
title: "joi: email multiple option lets one long input block Node event loop"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["api", "backend", "javascript", "joi", "node.js", "package"]
not_affected_if: ["length-checked-first", "no-multiple-option", "trusted-input-only"]
published_at: "2026-10-29T19:17:19+00:00"
first_seen_at: "2026-10-29T19:26:47+00:00"
updated_at: "2026-10-29T19:27:28+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118772", "first_seen_at": "2026-10-29T19:26:47+00:00"}]
---

# joi: email multiple option lets one long input block Node event loop

Joi's email validator with the multiple option uses a regular expression that runs in quadratic time on long whitespace runs. A single crafted request can block the Node.js event loop for seconds, stalling other work in the server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed joi version with `npm ls joi`; affected versions are from `17.1.1` up to but not including `17.13.9`, and `18.3.1`.
- Search the codebase for `email({ multiple: true })` or `email({multiple: true` to find validators that accept attacker-controlled input.
- Check whether a `.max()` length limit runs before the email rule, and whether `abortEarly: false` is set.

## Fix

- joi `17.x`: move to `17.13.9`
- joi `18.x`: move to `18.3.1`

## Timeline

- 2026-10-29T19:26:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118772

## From the sources

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_