{"affected":[{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"joi","product":"joi","source":"CNA: VulnCheck","vendor":"hapijs","versions":[{"lessThan":"17.13.9","status":"affected","version":"17.13.6","versionType":"semver"},{"lessThan":"18.3.1","status":"affected","version":"18.2.5","versionType":"semver"}]}],"cveId":"CVE-2026-122131","cwes":["CWE-1321"],"description":"Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.3,"severity":"medium","source":"CNA: VulnCheck","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","version":"4.0"},{"score":3.7,"severity":"low","source":"CNA: VulnCheck","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"}],"modifiedAt":1793824611069,"publishedAt":1793824611069,"references":[{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6"},{"source":"CNA: VulnCheck","tags":["product"],"url":"https://github.com/hapijs/joi"},{"source":"CNA: VulnCheck","tags":["patch"],"url":"https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec"},{"source":"CNA: VulnCheck","tags":["patch","issue-tracking"],"url":"https://github.com/hapijs/joi/pull/3164"},{"source":"CNA: VulnCheck","tags":["related","vendor-advisory"],"url":"https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"},{"source":"CNA: VulnCheck","tags":["technical-description"],"url":"https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67"},{"source":"CNA: VulnCheck","tags":["third-party-advisory"],"url":"https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key"}],"remediation":[{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec"},{"kind":"fix","source":"CNA: VulnCheck","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://github.com/hapijs/joi/pull/3164"}],"revision":"a8e1f05a7fa8878c9f7280f9999c48c093a17cff2a14b1d94f2c3fc603387c74","sources":[{"modifiedAt":1793824611069,"name":"CNA: VulnCheck","retrievedAt":1793826724906,"url":"https://www.cve.org/CVERecord?id=CVE-2026-122131"}],"ssvc":null,"status":"published","title":"Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key","updatedAt":1793826724906}