PT-2026-48686 · Root+3 · @Rootio/Joi+1

CVE-2026-48038 · Published 2026-06-11 · Updated 2026-07-14

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions joi versions prior to 17.13.4 joi versions prior to 18.2.1

Description A denial of service can occur in services that validate user-supplied JSON or object input using recursive link() schemas. When the validate() function is called without a try/catch block in a request handler, deeply nested input can trigger an unhandled RangeError, which may crash the process. In cases where validateAsync() is used or validate() is wrapped in a try/catch block, the system produces a RangeError instead of a structured ValidationError, which complicates error handling.

Recommendations Update to version 17.13.4 or later. Update to version 18.2.1 or later. As a temporary workaround, wrap the validation process in a try/catch block to prevent uncaught exceptions.

Exploit

Fix

Resource Exhaustion

Weakness Enumeration

CWE-248

CWE-400

Related Identifiers

CVE-2026-48038

GHSA-Q7CG-457F-VX79

Affected Products

@Rootio/Joi

Joi

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48038.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-48038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-48038 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-48038 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q7cg-457f-vx79 · Vendor Advisory
• https://github.com/hapijs/joi/pull/3113 · Note
• https://github.com/hapijs/joi/commit/fc146a628ab9cc250854407722d9f8738c9548e7 · Note
• https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79 · Note
• https://github.com/hapijs/joi/commit/97bd51de94d595a2d8949eb3bec0dbdd2f8a7a74 · Note
• https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11 · Note
• https://github.com/hapijs/joi · Note