{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/joi-17.1.1-17.13.8/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:hapi:joi:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-118772"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["joi (17.1.1-17.13.8)","joi (18.0.0-18.3.0)"],"_cs_severities":["low"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Hapi"],"content_html":"\u003cp\u003eA Regular Expression Denial of Service (ReDoS) vulnerability exists in the joi library when using the 'Joi.string().email({ multiple: true })' validation rule. The flaw stems from a regular expression used for separator handling, which exhibits quadratic time complexity when processing strings containing long sequences of whitespace without valid separators. This can lead to event loop blocking in Node.js applications, resulting in a denial of service. The vulnerability is present in versions 17.1.1 through 17.13.8, and 18.0.0 through 18.3.0.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an attacker to block the Node.js event loop for several seconds per request. Because the vulnerability can bypass existing string length limitations (such as .max() when abortEarly is set to false), it enables resource exhaustion via a single, specially crafted HTTP request.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the joi package to version 17.13.9 or 18.3.1 immediately to remediate the vulnerable regular expression logic.\u003c/li\u003e\n\u003cli\u003eAudit application code using 'Joi.string().email({ multiple: true })' to ensure input length is constrained prior to validation.\u003c/li\u003e\n\u003cli\u003eMonitor Node.js event loop lag and request processing times as indicators of potential exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T20:40:38Z","date_published":"2026-10-29T20:40:38Z","id":"https://feed.craftedsignal.io/briefs/2026-10-joi-redos/","summary":"The joi JavaScript validation library is vulnerable to a Regular Expression Denial of Service (ReDoS) attack when processing inputs via the email() rule with the multiple option enabled.","title":"joi: Regular expression denial of service in email validation (CVE-2026-118772)","url":"https://feed.craftedsignal.io/briefs/2026-10-joi-redos/"}],"language":"en","title":"CraftedSignal Threat Feed - Joi (17.1.1-17.13.8)","version":"https://jsonfeed.org/version/1.1"}