joi vulnerabilities

2 known vulnerabilities in joi from Hapijs. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  joi: Inefficient Regular Expression Complexity

  CVE-2026-118772Oct 29, 2026Hapijs

  joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position i

• 7.5 High severity

  joi: Inefficient Regular Expression Complexity

  CVE-2026-92599Sep 16, 2026Hapijs

  joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored,