All vulnerabilities
CVE-2026-92599GHSA-6h2x-m376-mqjq

joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`

hapijs joinpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
8.7High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.58%Chance of exploitation activity in the next 30 days, higher than 47% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in17.13.7Also 18.2.6GitHub
Published16 Sep 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Any application that validates a user-supplied string with Joi.string().isoDate() can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s.

Patches

Upgrade to version 17.13.7 or 18.2.6 depending on your current major version.

Workarounds

None except capping the length of the string before it reaches joi.

Text from GitHub Advisory Database

Affected versions 8

  • joi, npm>= 17.2.0, < 17.13.7GitHub
  • joi, npm>= 18.0.0, < 18.2.6GitHub
  • joiaffected: 17.2.0 before 17.13.7CVE List
  • joiunaffected: 17.13.7CVE List
  • joiaffected: 18.0.0 before 18.2.6CVE List
  • joiunaffected: 18.2.6CVE List
  • joi, npmfrom 17.2.0, fixed in 17.13.7OSV
  • joi, npmfrom 18.0.0, fixed in 18.2.6OSV

References 8