fix(deps): update dependency joi to v17 [security] - #78
Open
renovate[bot] wants to merge 1 commit into
Open
Conversation
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
2 times, most recently
from
June 13, 2026 05:31
32ffb2e to
f2a7071
Compare
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 12, 2026 17:28
f2a7071 to
d4a8d7d
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 13, 2026 00:58
d4a8d7d to
b6526ee
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 17, 2026 01:21
b6526ee to
082cc40
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 17, 2026 08:49
082cc40 to
d39b355
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 20, 2026 23:12
d39b355 to
34b01be
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 21, 2026 05:50
34b01be to
14e491b
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
2 times, most recently
from
July 24, 2026 23:34
a542ade to
2a87d8f
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 30, 2026 18:00
2a87d8f to
c1e58ae
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
July 30, 2026 22:06
c1e58ae to
c946b38
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 11, 2026 23:39
c946b38 to
617cfc4
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 12, 2026 05:30
617cfc4 to
ddbf98d
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 14, 2026 22:32
ddbf98d to
b791b0c
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 15, 2026 02:00
b791b0c to
321e780
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 21, 2026 18:08
321e780 to
66c0b04
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 21, 2026 21:44
66c0b04 to
80ce0ec
Compare
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 26, 2026 12:15
80ce0ec to
c70d9d3
Compare
renovate
Bot
changed the title
renovate
Bot
changed the title
renovate
Bot
force-pushed
the
renovate/npm-joi-vulnerability
branch
from
August 26, 2026 22:07
c70d9d3 to
901b22c
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
^14.0.0→^17.13.4joi has an uncaught RangeError on deeply nested input through recursive
link()schemasCVE-2026-48038 / GHSA-q7cg-457f-vx79
More information
Details
Impact
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
validate()called withouttry/catchin a request handler would cause an unhandled exception, potentially crashing the process.validateAsync()orvalidate()inside atry/catch, the validation fails, but the error type isRangeErrorrather than a structuredValidationError, complicating error handling.Patches
Upgrade to version >= 18.2.1.
Workarounds
Try/catch the validation to avoid uncaught exceptions.
References
Severity
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:LReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
hapijs/joi (joi)
v17.13.4Compare Source
v17.13.3Compare Source
v17.13.2Compare Source
v17.13.1Compare Source
v17.13.0Compare Source
v17.12.3Compare Source
v17.12.2Compare Source
v17.12.1Compare Source
v17.12.0Compare Source
v17.11.1Compare Source
v17.11.0Compare Source
v17.10.2Compare Source
v17.10.1Compare Source
v17.10.0Compare Source
v17.9.2Compare Source
v17.9.1Compare Source
v17.9.0Compare Source
v17.8.4Compare Source
v17.8.3Compare Source
v17.8.2Compare Source
v17.8.1Compare Source
v17.8.0Compare Source
v17.7.1Compare Source
v17.7.0Compare Source
v17.6.4Compare Source
v17.6.3Compare Source
v17.6.2Compare Source
v17.6.1Compare Source
v17.6.0Compare Source
v17.5.0Compare Source
v17.4.3Compare Source
v17.4.2Compare Source
v17.4.1Compare Source
v17.4.0Compare Source
v17.3.0Compare Source
v17.2.1Compare Source
v17.2.0Compare Source
v17.1.1Compare Source
v14.3.1Compare Source
v14.3.0Compare Source
v14.2.0Compare Source
v14.1.1Compare Source
v14.1.0Compare Source
v14.0.6Compare Source
v14.0.5Compare Source
v14.0.4Compare Source
v14.0.3Compare Source
v14.0.2Compare Source
v14.0.1Compare Source
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.