AIKIDO-2026-694299
joi is vulnerable to Prototype Pollution
37
Low Risk
This Affects:
joiTL;DR
joi's object().rename() supports regex patterns with template targets and the multiple option. Before the fix, an untrusted input key that matches the pattern can interpolate into a target such as __proto__, so the rename sets the prototype of the validated result object instead of creating a normal property. This allows prototype manipulation of the returned object when untrusted keys drive a template-based rename. The fix prevents rename from writing to prototype targets.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your schema uses object().rename() with a template target whose regex pattern matches untrusted input keys.
Background info
joi is vulnerable to Prototype Pollution in versions 17.1.1 - 17.13.4 and 18.0.0 - 18.2.3.
How to fix this
Upgrade the joi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.