JO
Product
joi
6
CVEs
0
On KEV
7.5
Max CVSS
1
New 30D
Severity mix
Critical 0High 2Medium 1Low 3
Watch
Add joi to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-118772 New | 7.5 | Oct 29 | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service Affected: >= 16.0.0, <= 17.1.1; >= 18.0.0, < 18.3.1 |
| CVE-2026-92599 | 7.5 | Sep 16 | Joi before 17.13.7 and 18.2.6 ReDoS via isoDate Affected: 17.2.0 before 17.13.7; 18.0.0 before 18.2.6 |
| CVE-2026-48038 | 5.3 | Jul 14 | joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas Affected: < 17.13.4; >= 18.0.0, < 18.2.1 |
| CVE-2026-90771 | 3.7 | Sep 13 | joi before 17.13.8 and 18.2.9 Prototype Pollution via messages Affected: 16.0.0 before 17.13.8; 18.0.0 before 18.2.9 |
| CVE-2026-84368 | 3.7 | Sep 1 | joi: Prototype pollution via a `__proto__` language key in custom messages Affected: >= 16.0.0, <= 17.1.1; >= 17.2.0, < 17.13.6; >= 18.0.0, < 18.2.5 |
| CVE-2026-84367 | 3.7 | Sep 1 | joi: object().rename() with a template target can set the validated object's prototype Affected: >= 16.0.0, < 17.13.5; >= 18.0.0, < 18.2.4 |
Showing 6