joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()`
### Impact Any application that validates a user-supplied string with `Joi.string().isoDate()` can be stalled by a single request. One of the regular expressions the rule runs over the input was unanchored, so a valid ISO date followed by a long run of fractional-second digits made the regex engine restart its search from every position in the string, costing time proportional to the square of the input length. 64 KB of digits costs about 1.4 s and 256 KB about 22 s. ### Patches Upgrade to version 17.13.7 or 18.2.6 depending on your current major version. ### Workarounds None except capping the length of the string before it reaches joi.
GHSA-6h2x-m376-mqjq
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-6h2x-m376-mqjq
joi
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 17.13.7
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
joi
Source reference: /affected/1/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 18.2.6
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "17.2.0"
},
{
"fixed": "17.13.7"
}
]
}
],
"package": {
"name": "joi",
"purl": "pkg:npm/joi",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6h2x-m376-mqjq/GHSA-6h2x-m376-mqjq.json"
}
},
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "18.0.0"
},
{
"fixed": "18.2.6"
}
]
}
],
"package": {
"name": "joi",
"purl": "pkg:npm/joi",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-6h2x-m376-mqjq/GHSA-6h2x-m376-mqjq.json"
}
}
]- Related CVEs
- CVE-2026-92599
Source reference:
/aliases
Publisher severity
high
Source reference: /database_specific/severity
- Event
- #85939 · Revision 1
- Added to Heist Feed
- Publisher date