Approved changes feed: RSS · Atom
cpe:2.3:a:@hapi:joi:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | @Hapi (9a45ba95-66c4-508c-a08f-ee3a9fc2cfd7) |
|---|---|
| Product | Joi (92f804f8-0f02-51ea-a3c1-bbb074b092d8) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-118772 |
vulnerable | 2026-11-03 10:17:04.432097 |
joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
HIGH (7.5)
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
Published: 2026-10-29T18:13:33.771Z
Updated: 2026-11-04T01:33:51.841Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.