AIKIDO-2026-220705

TL;DR

Joi's message compilation and merging logic in lib/messages.js accepts a message code named __proto__ and assigns it directly onto a plain messages object. Because the assigned value is always wrapped in a Template instance, the inherited __proto__ accessor replaces the object's own prototype instead of creating a property, so every other message code then resolves through that same template. Custom messages passed through .messages(), .prefs(), .validate(), and Joi.extend() can all reach this path in both flat and language-scoped message maps. The fix rejects __proto__ as a message code across all four entry points.