Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs …
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
An application that passes attacker-controlled data into joi's custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named proto was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new …
Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-proto with an object value and make the rename target render as …
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends on how the application invokes joi: Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process. Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating …