Most recent entries from all

EUVD-2026-337921

fkie_cve-2026-48038

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

GHSA-q7cg-457f-vx79 — joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

Affected: npm: joi

### Impact Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi: - Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process. - Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.

### Patches Upgrade to version >= 18.2.1.

### Workarounds Try/catch the validation to avoid uncaught exceptions.

### References - Pull request: hapijs/joi#3113