AIKIDO-2026-368003

TL;DR

joi compiles custom validation messages into a target object keyed by the language name inside its messages module. Before the fix, a language name of __proto__ or constructor causes joi to reuse an inherited object, so writing the localized messages assigns properties onto Object.prototype or other shared objects. This lets prototype pollution occur when an application builds a schema, message override, or extension from untrusted configuration, affecting every object in the process. The fix requires an own property on the target before writing and otherwise allocates a fresh object.