{"items":[{"id":"NVI-00013794","kind":"vulnerability","title":"joi: object().rename() with a template target can set the validated object's prototype","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gg4h-3hg2-grpc","CVE-2026-84367"],"plain_summary":"GitHub lists this reviewed advisory for joi, joi. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-05cf21a9a614a9733fc78f9b0dd54e38"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-09-08T20:51:23.000Z","value":"3.7 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-05cf21a9a614a9733fc78f9b0dd54e38"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-05cf21a9a614a9733fc78f9b0dd54e38","url":"https://github.com/advisories/GHSA-gg4h-3hg2-grpc","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gg4h-3hg2-grpc","publisher":"GitHub Advisory Database","observed_at":"2026-11-02T02:20:31.767Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-05cf21a9a614a9733fc78f9b0dd54e38"],"technology":"joi","known_exclusions":[],"conditions_summary":"### Impact\n\nApplications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern's own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.\n\nSchemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.\n\n### Patches\n\nVersions 17.13.5 and 18.2.4 have been released to address the issue.\n\n### Workarounds\n\n1. Replace the template rename target with a static string target.\n2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true })`\n3. Drop { multiple: true } from","public_affected_ranges":[">= 16.0.0, < 17.13.5"]},{"certainty":"source_listed","source_ids":["sr-05cf21a9a614a9733fc78f9b0dd54e38"],"technology":"joi","known_exclusions":[],"conditions_summary":"### Impact\n\nApplications are affected only if a schema renames keys with a regular-expression source and a `Joi.expression()` / `Joi.x()` target that interpolates the pattern's own match data, combined with `{ multiple: true }`, for example `.rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true })`. Because the target is rendered from the matched input key, an attacker who controls input keys can send `x-__proto__` with an object value and make the rename target render as `__proto__`, which sets the prototype of the object joi returns instead of creating a key on it. The global `Object.prototype` is not modified, so the effect is confined to the object returned by that one `validate()` call.\n\nSchemas using a static string rename target are not affected, and neither are schemas left on the default `{ multiple: false }`.\n\n### Patches\n\nVersions 17.13.5 and 18.2.4 have been released to address the issue.\n\n### Workarounds\n\n1. Replace the template rename target with a static string target.\n2. Keep the template but make the capture unable to produce `__proto__`, using a negative lookahead: `.rename(/^x-(?!__proto__$)(.+)$/, Joi.x('{#1}'), { multiple: true })`\n3. Drop { multiple: true } from","public_affected_ranges":[">= 18.0.0, < 18.2.4"]}],"null_published_at":"2026-11-02T10:00:37.150Z","source_updated_at":"2026-09-08T20:51:23.000Z","source_disclosed_at":"2026-09-08T20:51:21.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-02T02:20:31.767Z"}],"next_cursor":null,"snapshot_revision":"42594"}