Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

joi package may be exploited until updated

CVE-2026-84367 · published 4 days ago
Summary

The Joi validation library used in Node.js applications had a security weakness that could let an attacker interfere with your software. Updated versions of joi (including the hapijs/joi and @rootio/joi releases) are now available. Apply the latest version as soon as possible to protect your systems.

What to do
  • Update joi to version 17.13.5.
  • Update joi to version 18.2.4.
  • Update joi to version 17.13.5-aikido.1.
  • Update rootio @rootio/joi to version 17.13.5-root.io.1.
  • Update joi to version 17.13.5-aikido.2.
  • Update rootio @rootio/joi to version 17.13.5-root.io.2.
Affected software
Ecosystem VendorProductAffected versions
npm – joi >= 16.0.0, < 17.13.5
>= 18.0.0, < 18.2.4
Fix: upgrade to 17.13.5
– hapijs joi >= 16.0.0, < 17.13.5
Root:npm – joi < 17.13.5-aikido.1
< 17.13.5-aikido.2
Fix: upgrade to 17.13.5-aikido.1
Root:npm rootio @rootio/joi < 17.13.5-root.io.1
< 17.13.5-root.io.2
Fix: upgrade to 17.13.5-root.io.1
Original advisory text
CVE-2026-84367 in joi - Patched by Root
Root has patched CVE-2026-84367 in the joi package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
Timeline
Published14 Oct 2026
Updated15 Oct 2026
First seen2 Sep 2026
Sources
CVE-2026-84367 · NVD
CVE-2026-84367 · MITRE
GHSA-gg4h-3hg2-grpc · GHSA
ROOT-APP-NPM-CVE-2026-84367 · OSV
Track software like this
Free during beta