---
id: CVE-2026-122131
title: >-
  Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via
  __proto__ Language Key
summary: >-
  Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype
  pollution vulnerability in lib/messages.js compile() and merge() that fails to
  reject a __proto__ language key. Attackers supplying untrusted message
  configuration …
severity: low
cvss: 3.7
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-1321
vendor: hapijs
product: joi
affected:
  - joi >= 17.13.6 < 17.13.9
  - joi >= 18.2.5 < 18.3.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T19:39:47.724527Z'
published: '2026-11-04'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T19:40:15.094Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-122131'
references:
  - url: >-
      https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6
    label: Patch Commit
  - url: 'https://github.com/hapijs/joi'
  - url: >-
      https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec
  - url: 'https://github.com/hapijs/joi/pull/3164'
  - url: 'https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr'
    label: GitHub Security Advisory (GHSA-6w3j-5fw6-r9vr)
  - url: 'https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67'
  - url: >-
      https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key
    label: >-
      VulnCheck Advisory: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1
      Prototype Replacement via __proto__ Language Key
tags:
  - cve.org
epss: 0.0033
epssPercentile: 0.26253
ingestedAt: '2026-11-05T22:38:31.556Z'
---

## Overview

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

## Affected

- `joi >= 17.13.6 < 17.13.9`
- `joi >= 18.2.5 < 18.3.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.