Product by HackerOne
Joi
6 known vulnerabilities in Joi (HackerOne), 0 of them actively exploited (CISA KEV).
Key figures
6
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-92599 | Joi before 17.13.7 and 18.2.6 ReDoS via isoDate | 7.5 | |
| High | CVE-2026-118772 | joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service | 7.5 | |
| Medium | CVE-2026-90771 | joi before 17.13.8 and 18.2.9 Prototype Pollution via messages | 3.7 | |
| Medium | CVE-2026-48038 | joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas | 5.3 | |
| Low | CVE-2026-84368 | joi: Prototype pollution via a `__proto__` language key in custom messages | 3.7 | |
| Low | CVE-2026-84367 | joi: object().rename() with a template target can set the validated object's prototype | 3.7 |