CVE-2026-90771: Hapijs Joi

Low severity, CVSS 3.7. EPSS: 0.4% chance of exploitation in the next 30 days.

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Affected products

• Hapijs Joi: from 16.0.0, before 17.13.8 (fixed in 17.13.8); from 18.0.0, before 18.2.9 (fixed in 18.2.9)

Published 2026-09-13. Last modified 2026-09-24.