Vulnerability	Vulnerable Version
H Prototype Pollution Affected versions of this package are vulnerable to Prototype Pollution via the `compile()` and `merge()` functions in `lib/messages.js`, where passing `__proto__` as a top-level error-code key (or as a language-scoped sub-key) to the `.messages()` API triggers the legacy `__proto__` accessor on plain-object assignment, replacing the returned messages object's own prototype instead of creating an own property. An attacker who controls the messages configuration can overwrite `Object.prototype` properties, affecting the integrity of objects across the application. This is a sibling of the previously fixed GHSA-6w3j-5fw6-r9vr and GHSA-gg4h-3hg2-grpc, reaching flat write paths in both `compile()` and `merge()` that those fixes did not address. How to fix Prototype Pollution? Upgrade `joi` to version 17.13.8, 18.2.9 or higher.	>=17.1.1 <17.13.8>=18.0.0 <18.2.9

Prototype Pollution

Affected versions of this package are vulnerable to Prototype Pollution via the compile() and merge() functions in lib/messages.js, where passing __proto__ as a top-level error-code key (or as a language-scoped sub-key) to the .messages() API triggers the legacy __proto__ accessor on plain-object assignment, replacing the returned messages object's own prototype instead of creating an own property. An attacker who controls the messages configuration can overwrite Object.prototype properties, affecting the integrity of objects across the application. This is a sibling of the previously fixed GHSA-6w3j-5fw6-r9vr and GHSA-gg4h-3hg2-grpc, reaching flat write paths in both compile() and merge() that those fixes did not address.

How to fix Prototype Pollution?

Upgrade joi to version 17.13.8, 18.2.9 or higher.

>=17.1.1 <17.13.8>=18.0.0 <18.2.9

Go back to all versions of this package