VYPR
← All advisories
Medium severity5.3GHSA Advisory· Published Jul 14, 2026· Updated Jul 15, 2026

CVE-2026-48038

CVE-2026-48038

Description

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
joinpm
>= 18.0.0, < 18.2.118.2.1
joinpm
< 17.13.417.13.4

Affected products

37

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.