5.3

CVE-2026-48038: hapijs joi Uncaught Exception

CVSS: 5.3v3.1MediumAwaiting analysis
AliasesCGA-2q43-4793-pqf2CGA-3224-cjp8-mh33CGA-327c-qfv8-f62v
Published 14-07-2026Last modified 15-07-2026
Open JSON

Vulnerability summary

CVE-2026-48038 is a medium (CVSS 5.3) Uncaught Exception vulnerability in hapijs joi. EPSS estimates a 0.52% chance of exploitation in the next 30 days, higher than 43.2% of scored vulnerabilities.

Overall risk
21/100
0100
Low · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.52%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-73QJ-WQCV-39RP

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 15-07-2026
    Last modifiedVulnerability information updated.

Description

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

0.52%

Chance of exploitation in the next 30 days

Percentile

43%

Versus all other CVEs

30-day change

0.00 pp

From 0.52% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.52%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard51 products
  • arangodb-3.11All versions (No fix recorded)
  • arangodb-3.12All versions (No fix recorded)
  • gitlab-rails-ce-18.10All versions (No fix recorded)
  • gitlab-rails-ce-18.11< 18.11.6-r7
  • gitlab-rails-ce-18.5All versions (No fix recorded)
Wolfi12 products
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compatAll versions (No fix recorded)
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r40 | < 0.19.0-r31
  • katib-suggestion-nas-darts< 0.19.0-r31
Hapijs1 product
  • joi< 17.13.4 | ≥ 18.0.0, < 18.2.1
Npm1 product
  • joi≥ 18.0.0, < 18.2.1 | < 17.13.4

4 vendors · 65 products

References

8 links