@hapi/joi vulnerabilities
CVEs whose affected-version data names the @hapi/joi package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-118772High· 7.5joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
▾ Twilightjoi · joiEPSS 0.47%via GHSA
CVE-2026-84368Low· 3.7joi is a schema description language and data validator for JavaScript
joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where export…
▾ Sunlitjoi · joiEPSS 0.39%via NVD