{"affected":[{"product":"joi","source":"CNA: GitHub_M","vendor":"hapijs","versions":[{"status":"affected","version":">= 16.0.0, <= 17.1.1"},{"status":"affected","version":">= 18.0.0, < 18.3.1"}]},{"product":"joi","source":"CNA: GitHub_M","vendor":"@hapi","versions":[{"status":"affected","version":">= 16.0.0, <= 17.1.1"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"joi","product":"joi","source":"OSV GHSA-4528-x5fx-h6hg","vendor":"","versions":[{"events":[{"introduced":"17.1.1"},{"fixed":"17.13.9"}],"lessThan":"17.13.9","status":"affected","version":"17.1.1","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@hapi/joi","product":"@hapi/joi","source":"OSV GHSA-4528-x5fx-h6hg","vendor":"","versions":[{"events":[{"introduced":"16.0.0"},{"last_affected":"17.1.1"}],"lessThanOrEqual":"17.1.1","status":"affected","version":"16.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"joi","product":"joi","source":"OSV GHSA-4528-x5fx-h6hg","vendor":"","versions":[{"events":[{"introduced":"18.0.0"},{"fixed":"18.3.1"}],"lessThan":"18.3.1","status":"affected","version":"18.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118772","cwes":["CWE-1333"],"description":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.","epss":{"date":"2026-11-03","percentile":0.40493,"score":0.00467},"exploits":[{"kind":"exploit","source":"ADP: CISA-ADP","url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"}],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793756031841,"publishedAt":1793297613771,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/pull/3162"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/pull/3163"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/releases/tag/v17.13.9"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/hapijs/joi/releases/tag/v18.3.1"},{"source":"ADP: CISA-ADP","tags":["exploit"],"url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-4528-x5fx-h6hg"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}],"remediation":[{"kind":"fix","source":"OSV GHSA-4528-x5fx-h6hg","text":"joi (npm): OSV reports a fixed version 17.13.9. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-4528-x5fx-h6hg"},{"kind":"fix","source":"OSV GHSA-4528-x5fx-h6hg","text":"joi (npm): OSV reports a fixed version 18.3.1. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-4528-x5fx-h6hg"}],"revision":"95a0b0749068d5af4224f5fa54735d87bb2978648177ab1db0dcbf630e0876ba","sources":[{"modifiedAt":1793756031841,"name":"CNA: GitHub_M","retrievedAt":1793758124289,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118772"},{"modifiedAt":1793402107273,"name":"OSV / GitHub Security Advisories","retrievedAt":1793758125396,"url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793758142322,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118772"}],"ssvc":{"assessedAt":1793756006811,"automatable":"yes","exploitation":"poc","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","updatedAt":1793758142322}