AIKIDO-2026-912310
joi is vulnerable to Regular Expression Denial of Service (ReDoS)
75
High Risk
This Affects:
joiTL;DR
Joi.string().isoDate() pads bare hour timezone offsets with an unanchored regular expression that has a leading wildcard. A long value, such as a valid date followed by tens of thousands of fractional second digits, makes the regex engine restart from many string positions, so processing time grows with the square of the input length. A 64 KB string blocks the event loop for over a second and larger inputs stall it for many seconds, denying service to unauthenticated concurrent requests. The fix anchors the timeshift regex so isoDate() matching stays linear.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you validate untrusted strings with Joi.string().isoDate().
Background info
joi is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 17.2.0 - 17.13.6 and 18.0.0 - 18.2.5.
How to fix this
Upgrade the joi library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.