{"id":"GHSA-gg4h-3hg2-grpc","summary":"joi: object().rename() with a template target can set the validated object's prototype","details":"### Impact\n\nApplications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern's own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.\n\nSchemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.\n\n### Patches\n\nVersions 17.13.5 and 18.2.4 have been released to address the issue.\n\n### Workarounds\n\n1. Replace the template rename target with a static string target.\n2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true })`\n3. Drop { multiple: true } from the rename, which stops the rename before the assignment.","aliases":["CVE-2026-84367"],"modified":"2026-09-08T21:00:05.097709715Z","published":"2026-09-08T20:51:21Z","database_specific":{"cwe_ids":["CWE-1321"],"severity":"LOW","github_reviewed":true,"github_reviewed_at":"2026-09-08T20:51:21Z","nvd_published_at":"2026-09-01T21:18:47Z"},"references":[{"type":"WEB","url":"https://github.com/hapijs/joi/security/advisories/GHSA-gg4h-3hg2-grpc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84367"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3134"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3135"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/162f367aa178d2e1ebec8dc1164e5fe16536ddf6"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/172ececa192feda532b743d77bc9d3e523d19b01"},{"type":"PACKAGE","url":"https://github.com/hapijs/joi"},{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v17.13.5"},{"type":"WEB","url":"https://github.com/hapijs/joi/releases/tag/v18.2.4"}],"affected":[{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"16.0.0"},{"fixed":"17.13.5"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gg4h-3hg2-grpc/GHSA-gg4h-3hg2-grpc.json"}},{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.2.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-gg4h-3hg2-grpc/GHSA-gg4h-3hg2-grpc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"}]}