CVE-2026-84368: CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in hapijs joi

The hapijs joi package versions 16.0.0 through 17.13.5 and versions before 18.2.5 contain a prototype pollution vulnerability in lib/messages.js. Functions exports.compile() and exports.merge() reuse inherited objects for language keys supplied through various message-related APIs. An attacker can supply a language key named __proto__ or constructor to modify Object.prototype or Object static properties. This can cause applications that rely on inherited property checks to take incorrect code paths. The vulnerability is not exploitable via normal joi data validation but requires untrusted input to be passed into schema construction configuration. The issue is fixed in joi versions 17.13.6 and 18.2.5. No fixed versions exist for the older @hapi/joi package, which is affected through 17.1.1.

This vulnerability allows an attacker to modify JavaScript object prototypes via specially crafted language keys in joi schema construction configuration. This can cause applications that check for inherited properties to behave incorrectly, potentially leading to logic errors or security bypasses. However, the flaw does not impact the validation of normal data inputs and requires direct feeding of untrusted input into schema construction. The CVSS score is 3.7 (low severity), reflecting limited impact and exploitation complexity.

Upgrading to joi versions 17.13.6 or 18.2.5 resolves this vulnerability. No fixed versions exist for the older @hapi/joi package, so migrating to the maintained joi package and updating to a fixed version is recommended. Since the vulnerability requires untrusted input to be passed into schema construction configuration, avoiding this practice also mitigates the risk. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the description confirms fixes in joi 17.13.6 and 18.2.5.