The Joi library's `Joi.string().isoDate()` validation function contains a regular expression that is unanchored, causing quadratic backtracking when processing a valid ISO date followed by a long sequence of fractional-second digits. This results in the regex engine restarting its search from every position in the input string, leading to processing times that grow quadratically with input length. For example, 64 KB of digits can cause about 1.4 seconds of delay, and 256 KB can cause about 22 seconds. This vulnerability can stall applications that validate user-supplied strings using this method. The issue is fixed in Joi versions 17.13.7 and 18.2.6. No workarounds exist other than limiting input length before validation.

An attacker can cause a denial of service by sending a specially crafted string that triggers excessive regex backtracking in the isoDate validation, stalling the application for several seconds depending on input size. This impacts availability but does not affect confidentiality or integrity.

Upgrade to Joi version 17.13.7 or later if using the 17.x series, or 18.2.6 or later if using the 18.x series. No other workarounds are effective except limiting the length of input strings before validation. Since patches are available, applying the official fix is the recommended mitigation.