CVE-2026-118772
- Source
- https://cve.org/CVERecord?id=CVE-2026-118772
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118772.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-118772
- Aliases
- Downstream
CGA (30)
- CGA-2724-2c6x-fv5w
- CGA-2f2m-5mrg-4vm8
- CGA-4c96-3r46-433w
- CGA-5cgw-4hvv-7xxw
- CGA-6pr4-23r3-8rcx
- CGA-6r8j-5w34-gvg9
- CGA-6wc8-8g8c-6fc7
- CGA-7j8j-7c4r-8xx2
- CGA-85mv-2f56-xj7g
- CGA-8hgj-8vr8-hvfq
- CGA-8vqj-hm3m-gxxq
- CGA-8xf8-37w8-5jw6
- CGA-93j8-gv45-r6v3
- CGA-cc9q-5c6r-qjv9
- CGA-hhr7-6v8m-xqmj
- CGA-j6jv-326p-qpjx
- CGA-jrmg-gvqp-fwh4
- CGA-m23g-mmhp-8g5j
- CGA-m8wp-65r8-hr5x
- CGA-p7g4-3gw3-2jgw
- CGA-pm5p-2r3q-pg3x
- CGA-r46h-vr3w-8gcq
- CGA-r4r8-pwhx-rvf6
- CGA-rp3m-8g9h-w2mr
- CGA-rrv7-jrrr-77qq
- CGA-w9mh-mjwh-9hm2
- CGA-wffp-rv66-6qx8
- CGA-wq29-r82q-8hg6
- CGA-wxqp-2rxr-p535
- CGA-x9cx-r9hh-863r
ECHO (1)
ROOT (1)
- Published
- 2026-10-29T18:13:33Z
- Modified
- 2026-11-05T02:31:01Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
- Details
-
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1333" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118772.json" }- References
-
- https://github.com/hapijs/joi/releases/tag/v17.13.9
- https://github.com/hapijs/joi/releases/tag/v18.3.1
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118772.json
- https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg
- https://nvd.nist.gov/vuln/detail/CVE-2026-118772
- https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf
- https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e
- https://github.com/hapijs/joi/pull/3162
- https://github.com/hapijs/joi/pull/3163
Affected packages
Git / github.com/hapijs/joi
Affected ranges
- Type
- GIT
- Repo
- https://github.com/hapijs/joi
- Events
-
IntroducedLast AffectedIntroducedFixedFixedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "16.0.0" }, { "last_affected": "17.1.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "introduced": "18.0.0" }, { "fixed": "18.3.1" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "03dc1d909818503b06240dadc81e9227ed2649cf" } ], "source": "REFERENCES_COMMIT" }, { "range": [ { "fixed": "807858d7480f5075b0610817e3e44230890fb18e" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v17.13.9", "range": [ { "fixed": "5af45306226782035951fdc49f10fab5ebe021a2" } ], "source": "REFERENCES_TAG" }, { "original_tag": "v18.3.1", "range": [ { "fixed": "4009bfb93639b7da53b7cb1de2e2d8617d36d5f5" } ], "source": "REFERENCES_TAG" } ] }