Get real-time updates on Telegram

joi messages compilation allows prototype replacement through __proto__ error codes

CVE-2026-90771 affects joi. CVSS base score 3.7 (GitHub Advisory Database). EPSS 0.00389 (percentile 0.30649), scored 2026-10-04. Affected range: < 17.13.8. Fixed version: 17.13.8. Affected range: >= 18.0.0, < 18.2.9. Fixed version: 18.2.9.

Published 2026-10-06 00:14:27.191002+00:00

CVE

CVE-2026-90771

Product

joi

CCR priority

14.9 /100 (P5)

CVSS

3.7 /10 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N · GitHub Advisory Database

EPSS

0.00389 · percentile 0.30649 · 2026-10-04

KEV

no

Affected products

• joi · < 17.13.8 · Fixed version: 17.13.8
• joi · >= 18.0.0, < 18.2.9 · Fixed version: 18.2.9

Provenance

• GitHub Advisory Database · Source record · observed 2026-10-06 00:14:20.210633+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-90771.html