Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
3.7

joi package can be exploited without proper validation

CVE-2026-84368 · published 5 days ago
Summary

The joi validation library used in several Node.js projects (including hapi/joi and @rootio/joi) has a flaw that could let attackers send specially crafted data to bypass checks. Update to the latest patched versions of joi provided by the maintainer to protect your applications.

What to do
  • Update joi to version 17.13.6.
  • Update joi to version 18.2.5.
  • Update joi to version 17.13.6-aikido.1.
  • Update rootio @rootio/joi to version 17.13.6-root.io.1.
  • Update joi to version 17.13.6-aikido.2.
  • Update rootio @rootio/joi to version 17.13.6-root.io.2.
Affected software
Ecosystem VendorProductAffected versions
npm – joi >= 17.2.0, < 17.13.6
>= 18.0.0, < 18.2.5
Fix: upgrade to 17.13.6
npm hapi joi >= 16.0.0, <= 17.1.1
– hapijs joi >= 16.0.0, <= 17.1.1
Root:npm – joi < 17.13.6-aikido.1
< 17.13.6-aikido.2
Fix: upgrade to 17.13.6-aikido.1
Root:npm rootio @rootio/joi < 17.13.6-root.io.1
< 17.13.6-root.io.2
Fix: upgrade to 17.13.6-root.io.1
Original advisory text
CVE-2026-84368 in joi - Patched by Root
Root has patched CVE-2026-84368 in the joi package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
3.7 Low
Exploitation
<1% chance of attack within 30 days
Type
CWE-1321Prototype Pollution
Timeline
Published13 Oct 2026
Updated15 Oct 2026
First seen2 Sep 2026
Sources
CVE-2026-84368 · NVD
CVE-2026-84368 · MITRE
GHSA-6w3j-5fw6-r9vr · GHSA
ROOT-APP-NPM-CVE-2026-84368 · OSV
Track software like this
Free during beta