Vulnerability in hapijs joi

[ Description ]Official description

Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/hapijs/joi
• github.com/hapijs/joi/blob/v18.3.0/lib/messages.js
• github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6
• github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec
• github.com/hapijs/joi/pull/3164
• github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
• www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-protot…