CVE-2026-84367: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in hapijs joi

The vulnerability in hapijs joi involves improper control of object prototype attributes (CWE-1321), specifically a prototype pollution flaw in the internals.rename() function used by object().rename(). When a schema uses a regular-expression source for renaming keys combined with Joi.expression() or Joi.x() targets that interpolate the matched pattern data and the { multiple: true } option, an attacker can supply a key such as x-__proto__ with an object value. This causes the prototype of the object returned by validate() to be set to the attacker's object, rather than adding a normal own property. The global Object.prototype remains unaffected, so the pollution is confined to the validated object instance. This flaw affects joi versions from 16.0.0 up to but not including 17.13.5 and 18.2.4, where it has been fixed.

The vulnerability allows an attacker to modify the prototype of the object returned by the validate() function, potentially leading to unexpected behavior or logic errors in applications relying on joi for validation. However, the global Object.prototype is not modified, which limits the scope of the impact to the single validated object instance. The CVSS score is 3.7 (low), indicating limited impact with no confidentiality or availability effects and requiring network access with high attack complexity and no privileges or user interaction.

This vulnerability is fixed in joi versions 17.13.5 and 18.2.4. Users should upgrade to these versions or later to remediate the issue. There is no indication of vendor-provided temporary fixes or workarounds. If upgrading immediately is not possible, avoid using schemas that rename keys with regular-expression sources combined with Joi.expression() or Joi.x() targets that interpolate match data and the { multiple: true } option. Schemas using static-string targets or the default { multiple: false } are not affected.