joi: Regular expression denial of service in email validation (CVE-2026-118772)

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the joi library when using the 'Joi.string().email({ multiple: true })' validation rule. The flaw stems from a regular expression used for separator handling, which exhibits quadratic time complexity when processing strings containing long sequences of whitespace without valid separators. This can lead to event loop blocking in Node.js applications, resulting in a denial of service. The vulnerability is present in versions 17.1.1 through 17.13.8, and 18.0.0 through 18.3.0.

Impact

Successful exploitation allows an attacker to block the Node.js event loop for several seconds per request. Because the vulnerability can bypass existing string length limitations (such as .max() when abortEarly is set to false), it enables resource exhaustion via a single, specially crafted HTTP request.

Recommendation

• Update the joi package to version 17.13.9 or 18.3.1 immediately to remediate the vulnerable regular expression logic.
• Audit application code using 'Joi.string().email({ multiple: true })' to ensure input length is constrained prior to validation.
• Monitor Node.js event loop lag and request processing times as indicators of potential exploitation attempts.