{"id":"GHSA-q7cg-457f-vx79","summary":"joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas","details":"### Impact\nDenial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. \n\nThe blast radius depends on how the application invokes joi:\n- Highest impact: `validate()` called without `try/catch` in a request handler would cause an unhandled exception, potentially crashing the process.\n- Lower impact: `validateAsync()` or `validate()` inside a `try/catch`, the validation fails, but the error type is `RangeError` rather than a structured `ValidationError`, complicating error handling.\n\n### Patches\nUpgrade to version \u003e= 18.2.1.\n\n### Workarounds\nTry/catch the validation to avoid uncaught exceptions.\n\n### References\n- Pull request: hapijs/joi#3113","aliases":["CVE-2026-48038"],"modified":"2026-09-10T03:50:50.203035766Z","published":"2026-06-11T13:27:32Z","database_specific":{"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2026-06-11T13:27:32Z","nvd_published_at":null,"cwe_ids":["CWE-248","CWE-400"]},"references":[{"type":"WEB","url":"https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79"},{"type":"WEB","url":"https://github.com/hapijs/joi/pull/3113"},{"type":"WEB","url":"https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11"},{"type":"PACKAGE","url":"https://github.com/hapijs/joi"}],"affected":[{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"18.0.0"},{"fixed":"18.2.1"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q7cg-457f-vx79/GHSA-q7cg-457f-vx79.json"}},{"package":{"name":"joi","ecosystem":"npm","purl":"pkg:npm/joi"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"17.13.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-q7cg-457f-vx79/GHSA-q7cg-457f-vx79.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"}]}