3.7Niedrig
CVE-2026-90771joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
Beschreibung
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Schwachstellentyp (CWE):
CWE-1321
Daten: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Wiedergegeben wie in der Quelle, auf Englisch.
Betroffene Produkte und Versionen
Referenzen und Patches
- GitHub Issue #3150 issue-tracking
- https://github.com/hapijs/joi product
- https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js technical-description
- https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb patch
- VulnCheck Advisory: joi before 17.13.8 and 18.2.9 Prototype Pollution via messages third-party-advisory