{"id":"CVE-2026-118772","summary":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","details":"joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.","aliases":["GHSA-4528-x5fx-h6hg"],"modified":"2026-11-05T02:31:01.388310353Z","published":"2026-10-29T18:13:33.771Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1333"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118772.json"},"references":[{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v17.13.9"},{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v18.3.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118772.json"},{"type":"ADVISORY","url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772"},{"type":"FIX","url":"https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf"},{"type":"FIX","url":"https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e"},{"type":"FIX","url":"https://github.com/hapijs/joi/pull/3162"},{"type":"FIX","url":"https://github.com/hapijs/joi/pull/3163"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/hapijs/joi","events":[{"introduced":"b0356892c9342d340eab73f11d4086c0ceeebb9a"},{"last_affected":"b3833c45d68cf8efa09d74aadedd670d8958cd99"},{"introduced":"55b0096347c8bd963a9fc04060985344bb69f9ad"},{"fixed":"4009bfb93639b7da53b7cb1de2e2d8617d36d5f5"},{"fixed":"03dc1d909818503b06240dadc81e9227ed2649cf"},{"fixed":"807858d7480f5075b0610817e3e44230890fb18e"},{"fixed":"5af45306226782035951fdc49f10fab5ebe021a2"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"16.0.0"},{"last_affected":"17.1.1"}]},{"range":[{"introduced":"18.0.0"},{"fixed":"18.3.1"}],"source":"AFFECTED_FIELD","strategy":"StringRangeExpression"},{"range":[{"fixed":"03dc1d909818503b06240dadc81e9227ed2649cf"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"807858d7480f5075b0610817e3e44230890fb18e"}],"source":"REFERENCES_COMMIT"},{"range":[{"fixed":"5af45306226782035951fdc49f10fab5ebe021a2"}],"source":"REFERENCES_TAG","original_tag":"v17.13.9"},{"original_tag":"v18.3.1","range":[{"fixed":"4009bfb93639b7da53b7cb1de2e2d8617d36d5f5"}],"source":"REFERENCES_TAG"}]}}],"versions":["v18.3.0","v18.2.9","v18.2.8","v18.2.7","v18.2.6","v18.2.5","v18.2.4","v18.2.3","v18.2.2","v18.2.1","v18.2.0","v18.1.2","v18.1.1","v18.1.0","v18.0.2","v18.0.1","v18.0.0","v16.1.8","v17.1.1","v17.1.0","v17.0.2","v17.0.1","v17.0.0","v16.1.7","v16.1.6","v16.1.5","v16.1.4","v16.1.3","v16.1.2","v16.1.1","v16.1.0","v16.0.1","v16.0.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118772.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}