[pkg-vuln] CVE-2026-118772 in joi@17.13.8 #1444

New Issue

kert · 2026-11-02T06:03:07Z

kert commented

2026-11-02 06:03:07 +00:00

Severity: HIGH
Package: joi @ 17.13.8
Fixed in: 17.13.9, 18.3.1

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with t

Reference: https://nvd.nist.gov/vuln/detail/CVE-2026-118772

**Severity:** HIGH **Package:** `joi` @ `17.13.8` **Fixed in:** `17.13.9, 18.3.1` joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with t **Reference:** https://nvd.nist.gov/vuln/detail/CVE-2026-118772

kert added this to the P21: Package Supply Chain — inventory, mirrors, drift, vuln scanning milestone 2026-11-02 06:03:07 +00:00

kert added the quality ci labels 2026-11-02 06:03:07 +00:00

kert closed this issue

2026-11-03 04:18:26 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: homelab/stack#1444