CVE-2026-90771
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
CVE-2026-90771- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
EUVDEUVD-2026-76992
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
EUVD-2026-76992- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-wr44-6hxh-3jwq
joi messages compilation allows prototype replacement through __proto__ error codes
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
GHSA-wr44-6hxh-3jwq- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
NVD
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
CVE-2026-90771- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSV
joi before 17.13.8 and 18.2.9 Prototype Pollution via messages
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
CVE-2026-90771- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
OSVGHSA-wr44-6hxh-3jwq
joi messages compilation allows prototype replacement through __proto__ error codes
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
- Record
GHSA-wr44-6hxh-3jwq- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N - CVSS 3.1
- 3.7 Low
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-1321
- Updated
- 2026-11-02
Show 7 moreShow less
OSVRHSA-2026:67573
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:67573- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:67605
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:67605- CVSS 3.1
- 7.3 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2026:67610
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:67610- CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1791278886 No score
TuxCare security update for joi (1 CVE)
TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.2.
- Record
CLSA-2026-1791278886- Updated
- 2026-11-02
OSVCLSA-2026-1792486432 No score
TuxCare security update for @hapi/joi (3 CVEs)
TuxCare rebuilt @hapi/joi to address 3 CVEs. Fixed in 16.1.8-tuxcare.2.
- Record
CLSA-2026-1792486432- Updated
- 2026-11-02
OSVCLSA-2026-1792510126 No score
TuxCare security update for joi (4 CVEs)
TuxCare rebuilt joi to address 4 CVEs. Fixed in 17.13.4-tuxcare.1.
- Record
CLSA-2026-1792510126- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-90771 No score
CVE-2026-90771 in joi - Patched by Root
Root has patched CVE-2026-90771 in the joi package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-90771- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
joinpm |
before 17.13.8 | 17.13.8 |
joinpm |
18.0.0 up to 18.2.9 | 18.2.9 |
joiTuxCare:npm |
17.13.6-tuxcare.0 up to 17.13.6-tuxcare.2, plus listed versions 17.13.617.13.6-tuxcare.1 |
17.13.6-tuxcare.2 |
@hapi/joiTuxCare:npm |
16.1.8-tuxcare.0 up to 16.1.8-tuxcare.2, plus listed versions 16.1.816.1.8-tuxcare.1 |
16.1.8-tuxcare.2 |
joiTuxCare:npm |
17.13.4-tuxcare.0 up to 17.13.4-tuxcare.1, plus listed versions 17.13.4 |
17.13.4-tuxcare.1 |
grafana13.1Red Hat:hummingbird:1 |
before 0:13.1.3-0.9.hum1 | 0:13.1.3-0.9.hum1 |
grafana13.2Red Hat:hummingbird:1 |
before 0:13.2.1-0.4.hum1 | 0:13.2.1-0.4.hum1 |
grafana12.4Red Hat:hummingbird:1 |
before 0:12.4.10-0.3.hum1 | 0:12.4.10-0.3.hum1 |
joiRoot:npm |
before 18.2.9-aikido.1 | 18.2.9-aikido.1 |
@rootio/joiRoot:npm |
before 18.2.9-root.io.1 | 18.2.9-root.io.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90771 is a medium vulnerability (CVSS 6.3) in Hapijs Joi, published September 13, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in joi 17.13.8.
References
github.com/hapijs/joi/issues/3150
vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages
nvd.nist.gov/vuln/detail/CVE-2026-90771
Show 41 moreShow less
access.redhat.com/errata/RHSA-2026:67573
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json
bugzilla.redhat.com/show_bug.cgi?id=2491346
cve.org/CVERecord?id=CVE-2026-9029
grafana.com/security/security-advisories/cve-2026-9029