CVE-2026-84367 hapijs CVE debrief

Who should care

Developers and administrators using Joi versions between 16.0.0 and 17.13.4 or 18.2.3 should assess their exposure and apply patches or mitigations as needed. This includes reviewing and updating affected code, verifying input validation and sanitization, and monitoring for potential prototype pollution attempts. Security teams and vulnerability management teams should also be aware of the potential impacts and take steps to mitigate the vulnerability.

Why it matters

CVE-2026-84367 is a prototype pollution vulnerability in the Joi library that can be exploited by sending specially crafted input keys. While the global Object.prototype is not modified, the effect is confined to the object returned by the validation call. Developers and administrators using affected Joi versions should assess their exposure and apply patches or mitigations as needed.

• Potential prototype pollution in objects returned by Joi validation
• Possible modification of object prototypes in specific validation calls

Technical summary

The Joi library's object().rename() function is vulnerable to prototype pollution due to improper handling of regular-expression sources and Joi.expression() or Joi.x() targets with { multiple: true }. An attacker can exploit this by sending a specially crafted input key, potentially causing the prototype of the object returned by validate() to be modified. The vulnerability affects Joi versions between 16.0.0 and 17.13.4 or 18.2.3. Static-string targets and schemas using the default { multiple: false } are not affected.

Defensive priority

Assess and apply patches for Joi versions between 16.0.0 and 17.13.4 or 18.2.3, verify input validation and sanitization, and monitor for potential prototype pollution attempts.

Recommended defensive actions

• Apply patches for Joi versions between 16.0.0 and 17.13.4 or 18.2.3
• Verify input validation and sanitization in applications using Joi
• Monitor for potential prototype pollution attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the Joi prototype pollution vulnerability, including affected versions (16.0.0 to 17.13.4 and 18.2.3), fixed versions (17.13.5 and 18.2.4), and the nature of the vulnerability. The vulnerability allows an attacker to send specially crafted input keys that can modify the prototype of the object returned by Joi validation. Evidence from the CVE record and NVD entry suggests that the vulnerability is exploitable and can have significant impacts on applications using affected Joi versions.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.