CVE-2026-84367

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-84367
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84367.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-84367
Aliases
Downstream
Published
2026-09-01T20:33:29Z
Modified
2026-09-11T03:30:30Z
Severity
  • 3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
joi: object().rename() with a template target can set the validated object's prototype
Details

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-proto with an object value, causing the target to render as proto and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-1321"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84367.json"
}
References

Affected packages

Git / github.com/hapijs/joi

Affected ranges

Type
GIT
Repo
https://github.com/hapijs/joi
Events
Introduced
b0356892c9342d340eab73f11d4086c0ceeebb9a
Introduced
55b0096347c8bd963a9fc04060985344bb69f9ad
Fixed
566e73fa58e72f0a1dcbb3b110ee2f49f33aece3
Fixed
ea3e1560e293a750b47a73579b44b7cebeeac1c9
Fixed
162f367aa178d2e1ebec8dc1164e5fe16536ddf6
Fixed
172ececa192feda532b743d77bc9d3e523d19b01
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "16.0.0"
        },
        {
            "fixed": "17.13.5"
        },
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.2.4"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v16.*
v16.0.0
v16.0.1
v16.1.0
v16.1.1
v16.1.2
v16.1.3
v16.1.4
v16.1.5
v16.1.6
v16.1.7
v16.1.8
v17.*
v17.0.0
v17.0.1
v17.0.2
v17.1.0
v17.1.1
v17.10.0
v17.10.1
v17.10.2
v17.11.0
v17.11.1
v17.12.0
v17.12.1
v17.12.2
v17.12.3
v17.13.0
v17.13.1
v17.13.2
v17.13.3
v17.13.4
v17.2.0
v17.2.1
v17.3.0
v17.4.0
v17.4.1
v17.4.2
v17.4.3
v17.5.0
v17.6.0
v17.6.1
v17.6.2
v17.6.3
v17.6.4
v17.7.0
v17.7.1
v17.8.0
v17.8.1
v17.8.2
v17.8.3
v17.8.4
v17.9.0
v17.9.1
v17.9.2
v18.*
v18.0.0
v18.0.1
v18.0.2
v18.1.0
v18.1.1
v18.1.2
v18.2.0
v18.2.1
v18.2.2
v18.2.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-84367.json"