{"id":"CVE-2026-48038","aliases":["CLSA-2026-1792486432","EUVD-2026-44390","GHSA-q7cg-457f-vx79","ROOT-APP-NPM-CVE-2026-48038"],"status":"published","title":"joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas","description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00524,"percentile":0.44756,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-248","CWE-400"],"published":"2026-06-11T13:27:32Z","modified":"2026-10-28T02:31:04Z","fixes":[{"ecosystem":"npm","package":"joi","fixed_in":["18.2.1","17.13.4"],"sources":["ghsa","osv"]},{"ecosystem":"Root:npm","package":"joi","fixed_in":["17.13.3-aikido.1","17.13.3-aikido.2","17.13.3-aikido.3","17.13.3-aikido.4","17.13.4-aikido.1","17.13.4-aikido.2"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/joi","fixed_in":["17.13.3-root.io.1","17.13.3-root.io.2","17.13.3-root.io.3","17.13.3-root.io.4","17.13.4-root.io.1","17.13.4-root.io.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"18.2.1"}]}]},{"source":"ghsa","ecosystem":"npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.13.4"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hapi/joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.8-tuxcare.0"},{"fixed":"16.1.8-tuxcare.2"}]}],"versions":["16.1.8","16.1.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"npm","package":"joi","ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.2.1"}]}]},{"source":"osv","ecosystem":"npm","package":"joi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"17.13.4"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.13.3-aikido.1"},{"fixed":"17.13.3-aikido.2"},{"fixed":"17.13.3-aikido.3"},{"fixed":"17.13.3-aikido.4"},{"fixed":"17.13.4-aikido.1"},{"fixed":"17.13.4-aikido.2"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.13.3-root.io.1"},{"fixed":"17.13.3-root.io.2"},{"fixed":"17.13.3-root.io.3"},{"fixed":"17.13.3-root.io.4"},{"fixed":"17.13.4-root.io.1"},{"fixed":"17.13.4-root.io.2"}]}]}],"products":[{"vendor":"hapijs","product":"joi"}],"references":[{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/hapijs/joi/pull/3113","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7","tags":["x_refsource_MISC","fix"]},{"url":"https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q7cg-457f-vx79"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48038.json","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48038","tags":["advisory"]},{"url":"https://github.com/hapijs/joi","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-48038","title":"joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas","description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","status":"published","published":"2026-07-14T19:24:32.644Z","modified":"2026-07-15T13:27:13.334Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:19:47.998488Z"}],"euvd":[{"id":"EUVD-2026-44390","description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","status":"published","published":"2026-07-14T19:24:32Z","modified":"2026-07-15T13:27:13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T18:19:53.226345Z"}],"ghsa":[{"id":"GHSA-q7cg-457f-vx79","title":"joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas","description":"### Impact\nDenial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. \n\nThe blast radius depends on how the application invokes joi:\n- Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process.\n- Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.\n\n### Patches\nUpgrade to version \u003e= 18.2.1.\n\n### Workarounds\nTry/catch the validation to avoid uncaught exceptions.\n\n### References\n- Pull request: hapijs/joi#3113","status":"published","published":"2026-06-11T13:27:32Z","modified":"2026-06-12T19:28:28Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248","CWE-400"],"updated_at":"2026-11-02T14:40:27.329706Z"}],"nvd":[{"id":"CVE-2026-48038","description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","status":"published","published":"2026-07-14T20:17:05.563Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T14:12:29.879716Z"}],"osv":[{"id":"CVE-2026-48038","title":"joi: Uncaught RangeError on deeply nested input through recursive `link()` schemas","description":"joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.","status":"published","published":"2026-07-14T19:24:32.644Z","modified":"2026-10-28T02:31:04.40400366Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248"],"updated_at":"2026-11-02T15:45:06.701612Z"},{"id":"GHSA-q7cg-457f-vx79","title":"joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas","description":"### Impact\nDenial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. \n\nThe blast radius depends on how the application invokes joi:\n- Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process.\n- Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.\n\n### Patches\nUpgrade to version \u003e= 18.2.1.\n\n### Workarounds\nTry/catch the validation to avoid uncaught exceptions.\n\n### References\n- Pull request: hapijs/joi#3113","status":"published","published":"2026-06-11T13:27:32Z","modified":"2026-09-10T03:50:50.203035766Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-248","CWE-400"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"CLSA-2026-1792486432","title":"TuxCare security update for @hapi/joi (3 CVEs)","description":"TuxCare rebuilt @hapi/joi to address 3 CVEs. Fixed in 16.1.8-tuxcare.2.","status":"published","published":"2026-10-20T08:53:52Z","modified":"2026-10-20T13:45:10.569817686Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-CVE-2026-48038","title":"CVE-2026-48038 in joi - Patched by Root","description":"Root has patched CVE-2026-48038 in the joi package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-10-13T10:48:07Z","modified":"2026-10-13T11:15:04.156945595Z","updated_at":"2026-11-02T15:53:27.649662Z"}]}}