CVSS 4.0
6.3 mediumCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NCVE-2026-122131
Medium (6.3) in hapijs joi. EPSS 0.3% estimated probability of exploitation activity in the next 30 days. Fixed in joi 17.13.6, 18.2.5.
On this page
Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.
Severity
CVSS 3.1
3.7 lowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N- EPSS
- 0.3% estimated probability of exploitation activity in the next 30 days; 26th percentile. Scored 2026-11-10. A forecast for this CVE across the internet, not for your own systems.
- CISA's assessment (SSVC)
- Exploitation: none · Automatable: no · Technical impact: partial, assessed 2026-11-05. From CISA's Vulnrichment in the CVE List: whether it is exploited, whether exploiting it can be automated, and how much control it gives.
- CWE
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)
- Published
- Modified
- NVD analysis
- Awaiting analysis
- Record from
- the NVD, synced
Ask an AI about this CVE
Show the prompt
Explain CVE-2026-122131 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-122131?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-122131?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-122131 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.
Affected
Versions
From the CNA's record in the CVE List.
| Product | Affected |
|---|---|
| hapijs joi | from 17.13.6 before 17.13.9 |
| hapijs joi | from 18.2.5 before 18.3.1 |
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-6w3j-5fw6-r9vr | npm | joi | >=17.2.0 <17.13.6 | 17.13.6 |
| GHSA-6w3j-5fw6-r9vr | npm | @hapi/joi | >=16.0.0 <=17.1.1 | no fix published |
| GHSA-6w3j-5fw6-r9vr | npm | joi | >=18.0.0 <18.2.5 | 18.2.5 |
Red Hat
Red Hat rates this Low.
This vulnerability is rated as Low severity because exploitation requires an application to pass untrusted user input directly into internal schema configuration options rather than the validated payload itself. In typical Red Hat deployments and standard development practices, validation rules and message templates are statically defined by developers. As a result, the flaw is not reachable through standard validation flows, significantly limiting the practical attack surface.
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Hardened Images | grafana12.4 | Not affected | |
| Red Hat Hardened Images | grafana13.1 | Not affected | |
| Red Hat Hardened Images | grafana13.2 | Not affected |
Contains Red Hat Security Data © Red Hat, Inc., licensed under CC BY 4.0. Source: https://access.redhat.com/security/data. Modified: reformatted. Red Hat's page for CVE-2026-122131.
Attack patterns (CAPEC)
- CAPEC-1 Accessing Functionality Not Properly Constrained by ACLs Likelihood: High · Severity: High
- CAPEC-77 Manipulating User-Controlled Variables Likelihood: High · Severity: Very High
- CAPEC-180 Exploiting Incorrectly Configured Access Control Security Levels Likelihood: High · Severity: Medium
The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.
References
- https://github.com/hapijs/joi
- https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67
- https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6
- https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec
- https://github.com/hapijs/joi/pull/3164
- https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr
- https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key