Low severity3.7NVD Advisory· Published Sep 13, 2026· Updated Sep 24, 2026
CVE-2026-90771
CVE-2026-90771
Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
joinpm | < 17.13.8 | 17.13.8 |
joinpm | >= 18.0.0, < 18.2.9 | 18.2.9 |
Affected products
2Patches
Vulnerability mechanics
References
11- github.com/advisories/GHSA-wr44-6hxh-3jwqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-90771ghsaADVISORY
- github.com/hapijs/joi/blob/v18.2.8/lib/messages.jsnvdWEB
- github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2ghsaWEB
- github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afbnvdWEB
- github.com/hapijs/joi/issues/3150nvdWEB
- github.com/hapijs/joi/pull/3151ghsaWEB
- github.com/hapijs/joi/pull/3153ghsaWEB
- github.com/hapijs/joi/releases/tag/v17.13.8ghsaWEB
- github.com/hapijs/joi/releases/tag/v18.2.9ghsaWEB
- www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messagesnvdWEB
News mentions
0No linked articles in our index yet.