Package vulnerability, severity high

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Published October 30, 2026, updated October 31, 2026

joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service. Source: GHSA-4528-x5fx-h6hg (CVE-2026-118772).

What's affected

• joi (npm)>=17.1.1 <17.13.9
• @hapi/joi (npm)>=16.0.0 <=17.1.1
• joi (npm)>=18.0.0 <18.3.1

What to do

1. Upgrade joi to 17.13.9 or later.
2. No fixed version of @hapi/joi yet: see the advisory for workarounds.
3. Upgrade joi to 18.3.1 or later.

Check whether you were affected

Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:

/pharon:check-incident ghsa-4528-x5fx-h6hg

References

• https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg
• https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg
• https://nvd.nist.gov/vuln/detail/CVE-2026-118772
• https://github.com/hapijs/joi/pull/3162
• https://github.com/hapijs/joi/pull/3163
• https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf
• https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e
• https://github.com/hapijs/joi
• https://github.com/hapijs/joi/releases/tag/v17.13.9
• https://github.com/hapijs/joi/releases/tag/v18.3.1

Notice ghsa-4528-x5fx-h6hg, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.