{"id":"CVE-2026-90771","aliases":["CLSA-2026-1791278886","CLSA-2026-1792486432","CLSA-2026-1792510126","EUVD-2026-76992","GHSA-wr44-6hxh-3jwq","RHSA-2026:67573","RHSA-2026:67605","RHSA-2026:67610","ROOT-APP-NPM-CVE-2026-90771"],"status":"published","title":"joi before 17.13.8 and 18.2.9 Prototype Pollution via messages","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","severity":{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00389,"percentile":0.3345,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-09-13T10:45:42Z","modified":"2026-11-03T14:15:05Z","fixes":[{"ecosystem":"npm","package":"joi","fixed_in":["17.13.8","18.2.9"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:npm","package":"joi","fixed_in":["17.13.6-tuxcare.2"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","fixed_in":["0:12.4.10-0.3.hum1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"joi","fixed_in":["18.2.9-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:npm","package":"@rootio/joi","fixed_in":["18.2.9-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.13.8"}]}]},{"source":"ghsa","ecosystem":"npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"18.0.0"},{"fixed":"18.2.9"}]}]},{"source":"osv","ecosystem":"TuxCare:npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.13.6-tuxcare.0"},{"fixed":"17.13.6-tuxcare.2"}]}],"versions":["17.13.6","17.13.6-tuxcare.1"]},{"source":"osv","ecosystem":"TuxCare:npm","package":"@hapi/joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"16.1.8-tuxcare.0"},{"fixed":"16.1.8-tuxcare.2"}]}],"versions":["16.1.8","16.1.8-tuxcare.1"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"17.13.4-tuxcare.0"},{"fixed":"17.13.4-tuxcare.1"}]}],"versions":["17.13.4"],"bundled":4},{"source":"osv","ecosystem":"npm","package":"joi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"17.13.8"}]}]},{"source":"osv","ecosystem":"npm","package":"joi","ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.2.9"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.1.3-0.9.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana13.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:13.2.1-0.4.hum1"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"grafana12.4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:12.4.10-0.3.hum1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.9-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:npm","package":"@rootio/joi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.2.9-root.io.1"}]}]}],"products":[{"vendor":"hapijs","product":"joi"}],"references":[{"url":"https://github.com/hapijs/joi/issues/3150","tags":["issue-tracking","exploit","report","web","article"]},{"url":"https://github.com/hapijs/joi","tags":["product","package","article"]},{"url":"https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js","tags":["technical-description","article","web"]},{"url":"https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb","tags":["patch","fix","web","article"]},{"url":"https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages","tags":["third-party-advisory","advisory","web","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771","tags":["advisory"]},{"url":"https://github.com/hapijs/joi/pull/3151","tags":["web"]},{"url":"https://github.com/hapijs/joi/pull/3153","tags":["web"]},{"url":"https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2","tags":["web"]},{"url":"https://github.com/hapijs/joi/releases/tag/v17.13.8","tags":["web"]},{"url":"https://github.com/hapijs/joi/releases/tag/v18.2.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wr44-6hxh-3jwq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90771.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67573","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-90771","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-9029","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-10601","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-75838","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491346","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-9029","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9029","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-9029","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2491359","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-10601","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10601","tags":["advisory"]},{"url":"https://grafana.com/security/security-advisories/cve-2026-10601","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2517772","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-75838","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75838","tags":["advisory"]},{"url":"https://github.com/cure53/DOMPurify/security/advisories/GHSA-55q2-fjhq-7xh7","tags":["article"]},{"url":"https://www.vulncheck.com/advisories/dompurify-before-cross-site-scripting-via-in-place-hook","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532688","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90771","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67605","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-61709","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2535473","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-61709","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61709","tags":["advisory"]},{"url":"https://github.com/openfga/openfga/commit/171806c93b86bca29e0212ceb8b6ee9c48eb9ac3","tags":["article"]},{"url":"https://github.com/openfga/openfga/releases/tag/v1.18.1","tags":["article"]},{"url":"https://github.com/openfga/openfga/security/advisories/GHSA-g3pg-frfm-pr2m","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2026:67610","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67610.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-90771","title":"joi before 17.13.8 and 18.2.9 Prototype Pollution via messages","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T10:45:42.498Z","modified":"2026-09-24T14:21:52.339Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T13:45:59.110885Z"}],"euvd":[{"id":"EUVD-2026-76992","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T10:45:42Z","modified":"2026-09-24T14:21:52Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T17:27:57.402158Z"}],"ghsa":[{"id":"GHSA-wr44-6hxh-3jwq","title":"joi messages compilation allows prototype replacement through __proto__ error codes","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T12:31:12Z","modified":"2026-10-05T23:29:53Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:27.036917Z"}],"nvd":[{"id":"CVE-2026-90771","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T11:17:01.613Z","modified":"2026-09-24T20:44:42.207Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:12:46.980627Z"}],"osv":[{"id":"CVE-2026-90771","title":"joi before 17.13.8 and 18.2.9 Prototype Pollution via messages","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T10:45:42.498Z","modified":"2026-10-28T02:31:12.843163434Z","cvss":[{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:45:20.269367Z"},{"id":"GHSA-wr44-6hxh-3jwq","title":"joi messages compilation allows prototype replacement through __proto__ error codes","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.","status":"published","published":"2026-09-13T12:31:12Z","modified":"2026-10-05T23:45:08.228760837Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"RHSA-2026:67573","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:44Z","modified":"2026-10-20T10:13:59Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67605","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-09-22T10:18:47Z","modified":"2026-10-20T10:14:02Z","cvss":[{"version":"3.1","score":7.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"RHSA-2026:67610","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","status":"published","published":"2026-09-22T10:18:49Z","modified":"2026-09-22T10:31:46.967719685Z","cvss":[{"version":"3.1","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:22.406388Z"},{"id":"CLSA-2026-1791278886","title":"TuxCare security update for joi (1 CVE)","description":"TuxCare rebuilt joi to address 1 CVE. Fixed in 17.13.6-tuxcare.2.","status":"published","published":"2026-10-06T09:28:06Z","modified":"2026-10-15T09:47:35.569131168Z","updated_at":"2026-11-02T15:43:49.016976Z"},{"id":"CLSA-2026-1792486432","title":"TuxCare security update for @hapi/joi (3 CVEs)","description":"TuxCare rebuilt @hapi/joi to address 3 CVEs. Fixed in 16.1.8-tuxcare.2.","status":"published","published":"2026-10-20T08:53:52Z","modified":"2026-10-20T13:45:10.569817686Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792510126","title":"TuxCare security update for joi (4 CVEs)","description":"TuxCare rebuilt joi to address 4 CVEs. Fixed in 17.13.4-tuxcare.1.","status":"published","published":"2026-10-20T15:28:46Z","modified":"2026-10-20T19:30:18.883518642Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"ROOT-APP-NPM-CVE-2026-90771","title":"CVE-2026-90771 in joi - Patched by Root","description":"Root has patched CVE-2026-90771 in the joi package for Root:npm. Multiple fixed versions available.","status":"published","published":"2026-11-03T13:46:29Z","modified":"2026-11-03T14:15:05.073131611Z","updated_at":"2026-11-03T14:35:32.508422Z"}]}}