CVE-2026-84368 joi: Prototype pollution via a `__proto__` language key in custom messages
Prototype pollution in joi allows attackers to corrupt Object.prototype via custom message keys, potentially bypassing security checks in consuming applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84368?
CVE-2026-84368 is a low-severity vulnerability in hapijs joi, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Weakness: CWE-1321
Which versions are affected by CVE-2026-84368?
6 open source packages ship an affected version, including joi and @hapi/joi.
| Package | Affected | Fixed in |
|---|---|---|
joi npm | From 17.2.0 | 17.13.6 |
joi npm | From 17.2.0 | 17.13.6 |
joi npm | From 18.0.0 | 18.2.5 |
joi npm | From 18.0.0 | 18.2.5 |
@hapi/joi npm | From 16.0.0 to 17.1.1 | None |
@hapi/joi npm | From 16.0.0 to 17.1.1 | None |
How do I fix CVE-2026-84368?
Upgrade joi to a fixed version for your release line: 17.13.6 or 18.2.5.
Is CVE-2026-84368 being exploited?
There is no known exploitation of CVE-2026-84368 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1791362244, ECHO-7ff3-9409-2629, GHSA-6w3j-5fw6-r9vr, MINI-3466-mhf3-25f4, MINI-49fh-wpxh-hc86, MINI-4pvg-j7m3-3pv3 and 16 more.