VYPR
← All advisories
Moderate severityGHSA Advisory· Published Jun 11, 2026· Updated Jun 11, 2026

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

CVE-2026-48038

Description

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi: - Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process. - Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

### Resources - Pull request: hapijs/joi#3113

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
joinpm
>= 18.0.0, < 18.2.118.2.1
joinpm
< 17.13.417.13.4

Affected products

33

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.