CVE-2026-122131 Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-122131?
CVE-2026-122131 is a medium-severity vulnerability in hapijs joi, published on 4 Nov 2026.
Official description
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.
Weakness: CWE-1321
Which versions are affected by CVE-2026-122131?
How do I fix CVE-2026-122131?
No fix has been published for CVE-2026-122131 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-122131 being exploited?
There is no known exploitation of CVE-2026-122131 in the wild and no public exploit code.
Sources
Also known as GHSA-gw37-7cc7-xmm6.