CVE-2026-90771 joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Attackers can pollute the prototype via custom error messages in joi, potentially leading to code execution or application crashes.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-90771?
CVE-2026-90771 is a medium-severity vulnerability in hapijs joi, published on 13 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Weakness: CWE-1321
Which versions are affected by CVE-2026-90771?
4 open source packages ship an affected version, including joi.
| Package | Affected | Fixed in |
|---|---|---|
joi npm | All versions | 17.13.8 |
joi npm | All versions | 17.13.8 |
joi npm | From 18.0.0 | 18.2.9 |
joi npm | From 18.0.0 | 18.2.9 |
Linux distribution packages (1)
grafana12.4 Red Hat:hummingbird:1 | All versions | 0:12.4.10-0.3.hum1 |
How do I fix CVE-2026-90771?
Upgrade joi to a fixed version for your release line: 17.13.8 or 18.2.9.
Is CVE-2026-90771 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-90771 exists.
Sources
Also known as CLSA-2026-1791278886, ECHO-9165-070e-db0f, GHSA-wr44-6hxh-3jwq, MINI-23f7-8g3x-x824, MINI-39p2-26qq-wxrr, MINI-4x3x-vj9j-pqg6 and 14 more.