Threats tagged 'ghsa-gw37-7cc7-xmm6'

Joi versions 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contain a prototype pollution vulnerability in the lib/messages.js file. The vulnerability arises because the compile() and merge() functions fail to reject a __proto__ language key. This allows attackers to supply untrusted message configurations that can replace the compiled messages prototype, potentially altering or breaking validation error rendering and any dependent logic.