@hapi/joi vulnerabilities (npm)

2 vulnerabilities.

• @hapi/joi npm joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service CVE-2026-118772 Fix available 7.5 HighOctober 29, 2026
• @hapi/joi npm joi: Prototype pollution via a `__proto__` language key in custom messages CVE-2026-84368 Fix available 3.7 LowSeptember 1, 2026