Answer in brief
CVE-2026-84368 records a Low severity (CVSS 3.7) vulnerability in joi: Prototype pollution via a `__proto__` language key in custom messages. The current sources do not mark it as known exploited. The current feed maps hapijs/joi (generic), @hapi/joi (npm), @hapi/joi (npm), joi (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 3.7. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps hapijs/joi (generic), @hapi/joi (npm), @hapi/joi (npm), joi (npm) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| hapijs/joigeneric | >= 16.0.0, <= 17.1.1 || >= 17.2.0, < 17.13.6 || >= 18.0.0, < 18.2.5 | Not reported |
| @hapi/joinpm | >=16.0.0,<=17.1.1 | Not reported |
| @hapi/joinpm | >=16.0.0 | Not reported |
| joinpm | >=17.2.0,<17.13.6 | 17.13.6 |
| joinpm | >=18.0.0,<18.2.5 | 18.2.5 |
| joinpm | >=17.2.0 <17.13.6 | 17.13.6 |
| joinpm | >=18.0.0 <18.2.5 | 18.2.5 |
Published upstream
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 9, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 1, 2026
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.
Quoted source text, attributed separately from HOL analysis.