CVE-2026-90771: hapijs joi Prototype Pollution
CVSS: 6.3v4.0MediumAwaiting analysis
AliasesRHSA-2026:67610CGA-m9wv-m53w-jqqmCGA-v9cc-gxwr-2c43GHSA-wr44-6hxh-3jwqCGA-2xrf-6xg5-7w4pCGA-34x3-97jg-5fm6CGA-3cj6-9gj5-9jhvCGA-3jcw-8r5v-xchfCGA-48cw-cq2h-9pmmCGA-4j6x-322w-9cp2CGA-4px5-f3xp-25gfCGA-6fxg-p7w2-694pCGA-6p53-3qxx-jfw6CGA-7w78-4h7m-9788CGA-8xpf-g734-22ffCGA-93rr-9p2h-6329CGA-9j6g-phgp-x78xCGA-c5vc-p97c-x777CGA-cgmg-p7jr-m5vpCGA-fhqc-c86f-55wxCGA-g7vh-hpxc-2328CGA-h2f3-j7jf-ggccCGA-h47w-qm47-cv36CGA-h75w-xc53-pw5fCGA-hffh-xv8j-hmfmCGA-hrxv-gj2q-7wg3CGA-m56h-hvg5-jh2pCGA-p8hp-3j73-5vqfCGA-ph42-hx67-qj32CGA-rr5j-rh32-q9p9CGA-v47w-973m-9f79CGA-vm3p-hr5f-ppvwCGA-vxq7-52w8-hvrjCGA-wfj2-j762-jpfxCGA-x25q-v539-m38wCGA-x5j6-7rvw-p7qmCGA-xhm9-xgfr-w9jqCGA-6qf6-cx44-x9h5CGA-98xw-m42p-c5c3CGA-cj24-322q-wf6jCGA-x3p6-hx6h-qg3f
Published 13-09-2026Last modified 24-09-2026
Vulnerability summary
CVE-2026-90771 is a medium (CVSS 6.3) Prototype Pollution vulnerability in hapijs joi. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.5% of scored vulnerabilities.
CVSS score
6.3/10
010
Medium · v4.0 (CVE.org)EPSS score
0.39%
0%100%
Low · +0.13 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 13-09-2026PublishedVulnerability first disclosed.
- 24-09-2026Last modifiedVulnerability information updated.
Description
joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
CVSS metrics
9 scores · 6 sources · 2 versionsMedium 6.3Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · NpmEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST6.3MediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low 3.7Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:NSources4 sources · 3.7–5.9
- OSV · Red hatEcosystem advisory · calculated5.9MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:NDiffers
- OSV · NpmEcosystem advisory · calculated3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
- NVDNIST3.7LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
32%
Versus all other CVEs
30-day change
+0.13 pp
From 0.26% on 19-09-2026
19-09-202619-10-2026
EPSS score0.39%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard17 products
- arangodb-3.11All versions (No fix recorded)
- arangodb-3.12All versions (No fix recorded)
- gitlab-rails-ce-18.8All versions (No fix recorded)
- gitlab-rails-ce-18.9All versions (No fix recorded)
- gitlab-rails-ce-fips-18.10< 18.10.8-r8
Wolfi2 products
- opensearch-dashboards-3< 3.8.0-r11
- thingsboard-tb-js-executorAll versions (No fix recorded) | < 4.4-r3
Hapijs1 product
- joi≥ 16.0.0, < 17.13.8 | ≥ 18.0.0, < 18.2.9
Npm1 product
- joi< 17.13.8 | ≥ 18.0.0, < 18.2.9
Redhat1 product
- grafana12.4< 0:12.4.10-0.3.hum1
5 vendors · 22 products
References
19 links- www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messagesThird Party AdvisoryARTICLEAdvisoryWEB
- images.redhat.comARTICLE
