CVE-2026-92599

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-92599
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92599.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-92599
Aliases
  • GHSA-6h2x-m376-mqjq
Published
2026-09-16T21:47:03Z
Modified
2026-09-18T03:30:26Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Joi before 17.13.7 and 18.2.6 ReDoS via isoDate
Details

joi (npm package joi, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the Joi.string().isoDate() validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-1333"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92599.json"
}
References

Affected packages

Git / github.com/hapijs/joi

Affected ranges

Type
GIT
Repo
https://github.com/hapijs/joi
Events
Introduced
755f14b51a627f760525ac47ff21eb541116eb83
Fixed
ed9d7cdd11ef5f7751fd46886f38dc605c9c3995
Introduced
55b0096347c8bd963a9fc04060985344bb69f9ad
Fixed
a4361e7a6c09fa37b5a7d2422c55ec852e821e72
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "17.2.0"
        },
        {
            "fixed": "17.13.7"
        },
        {
            "introduced": "18.0.0"
        },
        {
            "fixed": "18.2.6"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v17.*
v17.10.0
v17.10.1
v17.10.2
v17.11.0
v17.11.1
v17.12.0
v17.12.1
v17.12.2
v17.12.3
v17.13.0
v17.13.1
v17.13.2
v17.13.3
v17.13.4
v17.13.5
v17.13.6
v17.2.0
v17.2.1
v17.3.0
v17.4.0
v17.4.1
v17.4.2
v17.4.3
v17.5.0
v17.6.0
v17.6.1
v17.6.2
v17.6.3
v17.6.4
v17.7.0
v17.7.1
v17.8.0
v17.8.1
v17.8.2
v17.8.3
v17.8.4
v17.9.0
v17.9.1
v17.9.2
v18.*
v18.0.0
v18.0.1
v18.0.2
v18.1.0
v18.1.1
v18.1.2
v18.2.0
v18.2.1
v18.2.2
v18.2.3
v18.2.4
v18.2.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92599.json"