PT-2026-48686 · Npm · Joi

Published 2026-06-11 · Updated 2026-06-11 · CVE-2026-48038

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
• Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

Resources

• Pull request: hapijs/joi#3113

Fix

Resource Exhaustion

Weakness Enumeration

CWE-248

CWE-400

Related Identifiers

CVE-2026-48038

GHSA-Q7CG-457F-VX79

Affected Products

Joi

References · 5

• https://osv.dev/vulnerability/GHSA-q7cg-457f-vx79 · Vendor Advisory
• https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11 · Note
• https://github.com/hapijs/joi · Note
• https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79 · Note
• https://github.com/hapijs/joi/pull/3113 · Note