CVE-2026-122131 · Package
NO FIX YET · SEE WHAT TO DO
Joi, a JavaScript validation library, fails to reject a __proto__ language key when compiling messages, so attacker-supplied message configuration can replace the messages prototype. The result is altered or broken validation error rendering and dependent logic.
first public Aug 19, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that pass untrusted input into Joi message configuration, such as custom messages, prefs, validate options or Joi.extend, are exposed. Apps that only use fixed, developer-written schemas and messages are much less exposed. unknown whether any specific data path is exploitable beyond the prototype change described.
Not affected if fixed-schemas, no-user-supplied-messages, versions-outside-range
Who cares backend, javascript, joi, node.js
npm ls joi and compare it against the affected ranges 17.13.6 to before 17.13.9 and 18.2.5 to before 18.3.1.any().messages(, .prefs(, Joi.extend or validate options that take user-supplied objects.17.13.9 or later.18.3.1 or later.Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a proto language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.