[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
joi	17.13.7 → 17.13.8

---

joi messages compilation allows prototype replacement through proto error codes

CVE-2026-90771 / GHSA-wr44-6hxh-3jwq

More information

Details

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.

Severity

• CVSS Score: 6.3 / 10 (Medium)
• Vector String: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-90771
• https://github.com/hapijs/joi/issues/3150
• https://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb
• https://github.com/hapijs/joi
• https://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js
• https://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages
• https://github.com/hapijs/joi/pull/3151
• https://github.com/hapijs/joi/pull/3153
• https://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2
• https://github.com/hapijs/joi/releases/tag/v17.13.8
• https://github.com/hapijs/joi/releases/tag/v18.2.9
• https://github.com/advisories/GHSA-wr44-6hxh-3jwq

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hapijs/joi (joi)

v17.13.8

Compare Source

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.