| Package | Affected versions | Patched versions |
|---|---|---|
| joi | ≥ 18.0.0, < 18.2.1< 17.13.4 | 18.2.117.13.4 |
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.Upgrade to version >= 18.2.1.
Try/catch the validation to avoid uncaught exceptions.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free