CVE-2026-122131

Published: Nov 4, 2026Modified: Nov 5, 2026

6.3

Vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Show more

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less

Source: disclosure@vulncheck.com (Secondary)

Description

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

Related CWEs

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

References (7)

https://github.com/hapijs/joi

Source: disclosure@vulncheck.com

https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67

Source: disclosure@vulncheck.com

https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6

Source: disclosure@vulncheck.com

https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec

Source: disclosure@vulncheck.com

https://github.com/hapijs/joi/pull/3164

Source: disclosure@vulncheck.com

https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr

Source: disclosure@vulncheck.com

https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key

Source: disclosure@vulncheck.com

Timeline

No history available yet.