{"schemaVersion":3,"id":"CVE-2026-84368","aliases":["CGA-fff5-jh2q-8m45","CGA-q6cq-q7j7-42cf","GHSA-6w3j-5fw6-r9vr","CGA-2jxr-8qxw-43vv","CGA-2mmc-rfwx-8cvf","CGA-2qp7-9x8q-34g2","CGA-2r59-8gmp-hv9p","CGA-36r2-v8r3-38p4","CGA-4799-j3gj-4wqr","CGA-5w3f-8w52-gpj4","CGA-668r-45wc-r5m6","CGA-67q2-7456-7m43","CGA-8hxr-88qw-wx9v","CGA-9373-cqx8-rv88","CGA-9h4g-54cr-3p7j","CGA-9j2f-wg6w-xhhv","CGA-9jvj-vq8j-8f5c","CGA-9p8v-776m-mwcf","CGA-9phq-phcc-p9wp","CGA-c3rf-vw4x-qqvg","CGA-f5cx-73qv-qw62","CGA-f5j9-c2rw-jvc2","CGA-f7p6-q7vr-68h3","CGA-f83x-hpmc-3557","CGA-fjq4-32xh-w7vf","CGA-g7h5-9v8h-82f2","CGA-g924-xvf2-v472","CGA-gc2f-f3hv-5qf8","CGA-h5g5-qmxv-c53m","CGA-hmhh-vvfc-9366","CGA-j9hw-fp57-gxrp","CGA-jcpf-m935-f4j7","CGA-jpm8-vjqp-3rpq","CGA-m237-2h88-q2cw","CGA-m3vp-vq6w-vj52","CGA-mc92-g2wm-xwhv","CGA-mqpx-6wrq-2qpv","CGA-mwvx-cf82-v23q","CGA-p2pr-8596-w8v3","CGA-p5fm-r5vx-4w2w","CGA-qh63-9ww9-cggm","CGA-qph6-5ffh-xrh2","CGA-rg66-5wmm-gg5p","CGA-rhjm-g55f-fh4c","CGA-vff7-c73m-g5g2","CGA-vh47-36v5-wx87","CGA-w4p3-hrq5-4r7r","CGA-w7g9-37m6-6pq9","CGA-xjm5-wr45-38qf","CGA-xqjv-9gm7-937j","CGA-xxxj-wqvm-q77v","CGA-jv56-25w3-53qc","CGA-m252-v3wg-rqph","CGA-mh6w-3h5w-w73c","CGA-mh82-27vc-hfgp"],"status":"published","duplicateOf":null,"title":null,"description":"joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named __proto__ writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @hapi/joi version is available.","dates":{"published":"2026-09-01T20:36:51.859Z","modified":"2026-09-02T12:18:07.627Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":3.7,"severity":"low","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Wolfi","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Npm","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Chainguard","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":5.6,"impact":2.3,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":3.7,"severity":"low","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00389,"percentile":0.31557,"severity":"low","asOf":"2026-10-20T00:00:00.000Z","change":{"pp":0.13399999999999995,"baselineDate":"2026-09-20T00:00:00.000Z","baselineScore":0.00255},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00389,"percentile":0.31557}],"last30":[{"date":"2026-09-20T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00255,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00389,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.00389,"percentile":0.31557}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-1321","name":"Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')","description":"The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.","type":"weakness","status":"Incomplete","abstraction":"Variant","likelihoodOfExploit":null,"url":"https://cwe.mitre.org/data/definitions/1321.html"}],"affected":[{"vendor":"chainguard","product":"gitlab-rails-ce-18.10","name":"gitlab-rails-ce-18.10","label":"gitlab-rails-ce-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.10","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.7","name":"gitlab-rails-ce-18.7","label":"gitlab-rails-ce-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.8","name":"gitlab-rails-ce-18.8","label":"gitlab-rails-ce-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-18.9","name":"gitlab-rails-ce-18.9","label":"gitlab-rails-ce-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-18.9","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.10","name":"gitlab-rails-ce-fips-18.10","label":"gitlab-rails-ce-fips-18.10","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.10","purlType":"apk","versions":[{"text":"< 18.10.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.10.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.7","name":"gitlab-rails-ce-fips-18.7","label":"gitlab-rails-ce-fips-18.7","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.7","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.8","name":"gitlab-rails-ce-fips-18.8","label":"gitlab-rails-ce-fips-18.8","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.8","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-18.9","name":"gitlab-rails-ce-fips-18.9","label":"gitlab-rails-ce-fips-18.9","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-18.9","purlType":"apk","versions":[{"text":"< 18.9.8-r8","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 18.9.8-r8","eol":null,"hubHref":null},{"vendor":"chainguard","product":"gitlab-rails-ce-fips-19.0","name":"gitlab-rails-ce-fips-19.0","label":"gitlab-rails-ce-fips-19.0","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/gitlab-rails-ce-fips-19.0","purlType":"apk","versions":[{"text":"< 19.0.9-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 19.0.9-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19","name":"kibana-8.19","label":"kibana-8.19","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19","purlType":"apk","versions":[{"text":"< 8.19.21-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.21-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-bitnami","name":"kibana-8.19-bitnami","label":"kibana-8.19-bitnami","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-bitnami","purlType":"apk","versions":[{"text":"< 8.19.21-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.19.21-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-8.19-iamguarded","name":"kibana-8.19-iamguarded","label":"kibana-8.19-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-8.19-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3","name":"kibana-9.3","label":"kibana-9.3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.3-iamguarded","name":"kibana-9.3-iamguarded","label":"kibana-9.3-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.3-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4","name":"kibana-9.4","label":"kibana-9.4","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4","purlType":"apk","versions":[{"text":"< 9.4.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.4-iamguarded","name":"kibana-9.4-iamguarded","label":"kibana-9.4-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.4-iamguarded","purlType":"apk","versions":[{"text":"< 9.4.6-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.4.6-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.5","name":"kibana-9.5","label":"kibana-9.5","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.5","purlType":"apk","versions":[{"text":"< 9.5.3-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 9.5.3-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"kibana-9.5-iamguarded","name":"kibana-9.5-iamguarded","label":"kibana-9.5-iamguarded","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/kibana-9.5-iamguarded","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.8.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.0-r5","eol":null,"hubHref":null},{"vendor":"chainguard","product":"opensearch-dashboards-3-fips","name":"opensearch-dashboards-3-fips","label":"opensearch-dashboards-3-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/opensearch-dashboards-3-fips","purlType":"apk","versions":[{"text":"< 3.8.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.0-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"pelias-api","name":"pelias-api","label":"pelias-api","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/pelias-api","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.4-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.4-r3","eol":null,"hubHref":null},{"vendor":"chainguard","product":"thingsboard-tb-js-executor-fips","name":"thingsboard-tb-js-executor-fips","label":"thingsboard-tb-js-executor-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/thingsboard-tb-js-executor-fips","purlType":"apk","versions":[{"text":"< 4.4-r1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 4.4-r1","eol":null,"hubHref":null},{"vendor":"chainguard","product":"unleash","name":"unleash","label":"unleash","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/unleash","purlType":"apk","versions":[{"text":"< 8.2.0-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.2.0-r0","eol":null,"hubHref":null},{"vendor":"chainguard","product":"unleash-fips","name":"unleash-fips","label":"unleash-fips","ecosystem":"Chainguard","cpePart":null,"purl":"pkg:apk/chainguard/unleash-fips","purlType":"apk","versions":[{"text":"< 8.1.0-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 8.1.0-r3","eol":null,"hubHref":null},{"vendor":"wolfi","product":"opensearch-dashboards-3","name":"opensearch-dashboards-3","label":"opensearch-dashboards-3","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/opensearch-dashboards-3","purlType":"apk","versions":[{"text":"< 3.8.0-r5","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 3.8.0-r5","eol":null,"hubHref":null},{"vendor":"wolfi","product":"thingsboard-tb-js-executor","name":"thingsboard-tb-js-executor","label":"thingsboard-tb-js-executor","ecosystem":"Wolfi","cpePart":null,"purl":"pkg:apk/wolfi/thingsboard-tb-js-executor","purlType":"apk","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null},{"text":"< 4.4-r3","noFixRecorded":false,"fixedIn":null}],"versionsText":"All versions (No fix recorded) | < 4.4-r3","eol":null,"hubHref":null},{"vendor":"hapijs","product":"joi","name":"joi","label":"joi","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 16.0.0, ≤ 17.1.1","noFixRecorded":false,"fixedIn":null},{"text":"≥ 17.2.0, < 17.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 18.0.0, < 18.2.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, ≤ 17.1.1 | ≥ 17.2.0, < 17.13.6 | ≥ 18.0.0, < 18.2.5","eol":null,"hubHref":"/vendor/hapijs/joi"},{"vendor":"@hapi","product":"joi","name":"@hapi/joi","label":"joi","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/@hapi/joi","purlType":"npm","versions":[{"text":"≥ 16.0.0, ≤ 17.1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 16.0.0, ≤ 17.1.1","eol":null,"hubHref":null},{"vendor":"Npm","product":"joi","name":"joi","label":"joi","ecosystem":"Npm","cpePart":null,"purl":"pkg:npm/joi","purlType":"npm","versions":[{"text":"≥ 17.2.0, < 17.13.6","noFixRecorded":false,"fixedIn":null},{"text":"≥ 18.0.0, < 18.2.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 17.2.0, < 17.13.6 | ≥ 18.0.0, < 18.2.5","eol":null,"hubHref":null}],"affectedCount":30,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","label":"github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr","hostname":"github.com","tags":["X Refsource CONFIRM","Advisory","WEB"]},{"url":"https://github.com/hapijs/joi/pull/3138","label":"github.com/hapijs/joi/pull/3138","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/hapijs/joi/pull/3139","label":"github.com/hapijs/joi/pull/3139","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","label":"github.com/hapijs/joi/commit/8d0b808f3e874d28f9078f61b7742290989afb36","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","label":"github.com/hapijs/joi/commit/90d07571923c90e3432a328fc041d1cda03d30fa","hostname":"github.com","tags":["X Refsource MISC","FIX","WEB"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84368.json","label":"github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84368.json","hostname":"github.com","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-84368","label":"nvd.nist.gov/vuln/detail/CVE-2026-84368","hostname":"nvd.nist.gov","tags":["Advisory"]},{"url":"https://github.com/hapijs/joi","label":"github.com/hapijs/joi","hostname":"github.com","tags":["PACKAGE"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-09-01T20:36:51.859Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-09-02T12:18:07.627Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":15,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T19:13:49.538Z","stale":false,"partial":false}}