The vulnerability in hapijs joi before versions 17.13.8 and 18.2.9 allows an attacker to supply __proto__ keys in custom messages. This leads to prototype pollution by replacing the prototype of the returned object. The issue resides in the messages compilation function, which does not properly control modification of object prototype attributes. This can break code that depends on standard Object.prototype behavior.

An attacker can manipulate the prototype of objects returned by the messages compilation function, potentially causing unexpected behavior or logic errors in applications relying on Object.prototype methods. This could lead to application instability or security issues depending on how the polluted prototype is leveraged. The CVSS score of 6.3 indicates a medium severity impact with network attack vector, high attack complexity, and no privileges or user interaction required.

Upgrading to hapijs joi versions 17.13.8 or later, or 18.2.9 or later, addresses this vulnerability. Users should apply these official fixes to remediate the prototype pollution issue. No other mitigation steps are indicated by the vendor advisory.