Advisories for Npm/Joi package

An application that passes attacker-controlled data into joi's custom message configuration (messages(), message(), prefs({ messages }), Joi.extend({ messages }) or rule({ message })) lets the attacker write properties onto Object.prototype, where every object in the process then inherits them. A key named proto was treated as a language name, and the code reused the object it found at that key, which resolves to the prototype rather than to a new …

Applications are affected only if a schema renames keys with a regular-expression source and a Joi.expression() / Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, for example .rename(/^x-(.+)$/, Joi.x('{#1}'), { multiple: true }). Because the target is rendered from the matched input key, an attacker who controls input keys can send x-proto with an object value and make the rename target render as …

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas. The blast radius depends on how the application invokes joi: Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process. Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating …