CVE-2026-122131
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 04, 2026
Vendor
unknown
Description
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.