CVE-2026-118772

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

Summary

Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

Details

When the multiple option is set, the email rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);
// ...
const emails = options.multiple ? value.split(regex) : [value];

String.prototype.split tries a match at each position of the value. At each position inside a whitespace run, the leading \s* reads the rest of the run, does not find a separator, and backtracks through all of it. A run of n whitespace characters without a separator therefore costs n² steps. This applies to the default separator and to all custom separator values.

The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

const regex = new RegExp(`(?:(?<!\\s)\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);

The split results do not change. The regular expression is now built only when multiple is set.

Every joi release from 17.1.1 up to and including 17.13.8, and from 18.0.0 up to and including 18.3.0, is affected. Every @hapi/joi release from 16.0.0 is affected.

Workarounds for users who cannot upgrade:

• Add .max() before .email(), for example Joi.string().max(1000).email({ multiple: true }). The max rule then rejects long values before the email rule runs.
• Do not use the abortEarly: false option with this schema. With abortEarly: false, the email rule runs even when the max rule fails.
• Do not use .trim() as a workaround. It removes only the whitespace at the start and at the end of the value.

Proof of concept

const Joi = require('joi');

const schema = Joi.string().email({ multiple: true });
for (const n of [25000, 50000, 100000, 200000]) {
    const start = Date.now();
    schema.validate(' '.repeat(n));
    console.log(`${n} spaces: ${Date.now() - start} ms`);
}

Output on [email protected] (Node.js 26):

25000 spaces: 244 ms
50000 spaces: 887 ms
100000 spaces: 3349 ms
200000 spaces: 13579 ms

Output on the patched version:

25000 spaces: 0 ms
50000 spaces: 0 ms
100000 spaces: 0 ms
200000 spaces: 1 ms

Over HTTP, send the whitespace in a field that the route validates with this schema:

POST /invite HTTP/1.1
Content-Type: application/json

{"emails": "<100000 spaces>"}

Impact

This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with Joi.string().email({ multiple: true }) and that has no length limit before the email rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.

Summary

Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

Details

When the multiple option is set, the email rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:

const regex = new RegExp(`\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);
// ...
const emails = options.multiple ? value.split(regex) : [value];

String.prototype.split tries a match at each position of the value. At each position inside a whitespace run, the leading \s* reads the rest of the run, does not find a separator, and backtracks through all of it. A run of n whitespace characters without a separator therefore costs n² steps. This applies to the default separator and to all custom separator values.

The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:

const regex = new RegExp(`(?:(?<!\\s)\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\s*`);

The split results do not change. The regular expression is now built only when multiple is set.

Every joi release from 17.1.1 up to and including 17.13.8, and from 18.0.0 up to and including 18.3.0, is affected. Every @hapi/joi release from 16.0.0 is affected.

Workarounds for users who cannot upgrade:

• Add .max() before .email(), for example Joi.string().max(1000).email({ multiple: true }). The max rule then rejects long values before the email rule runs.
• Do not use the abortEarly: false option with this schema. With abortEarly: false, the email rule runs even when the max rule fails.
• Do not use .trim() as a workaround. It removes only the whitespace at the start and at the end of the value.

Proof of concept

const Joi = require('joi');

const schema = Joi.string().email({ multiple: true });
for (const n of [25000, 50000, 100000, 200000]) {
    const start = Date.now();
    schema.validate(' '.repeat(n));
    console.log(`${n} spaces: ${Date.now() - start} ms`);
}

Output on [email protected] (Node.js 26):

25000 spaces: 244 ms
50000 spaces: 887 ms
100000 spaces: 3349 ms
200000 spaces: 13579 ms

Output on the patched version:

25000 spaces: 0 ms
50000 spaces: 0 ms
100000 spaces: 0 ms
200000 spaces: 1 ms

Over HTTP, send the whitespace in a field that the route validates with this schema:

POST /invite HTTP/1.1
Content-Type: application/json

{"emails": "<100000 spaces>"}

Impact

This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with Joi.string().email({ multiple: true }) and that has no length limit before the email rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.

TuxCare rebuilt @hapi/joi to address 1 CVE. Fixed in 16.1.8-tuxcare.3.

TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.3.

Root has patched CVE-2026-118772 in the joi package for Root:npm. Multiple fixed versions available.