CVE-2026-122131

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-122131", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-11-04T18:13:10.837Z", "datePublished": "2026-11-04T20:36:51.069Z", "dateUpdated": "2026-11-05T19:40:15.094Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:51.069Z"}, "datePublic": "2026-10-28T00:00:00.000Z", "title": "Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key", "descriptions": [{"lang": "en", "value": "Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "cweId": "CWE-1321", "type": "CWE"}]}], "affected": [{"vendor": "hapijs", "product": "joi", "defaultStatus": "unaffected", "packageURL": "pkg:npm/joi", "versions": [{"version": "17.13.6", "status": "affected", "lessThan": "17.13.9", "versionType": "semver"}, {"version": "18.2.5", "status": "affected", "lessThan": "18.3.1", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW"}}], "references": [{"url": "https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6", "tags": ["patch"], "name": "Patch Commit"}, {"url": "https://github.com/hapijs/joi", "tags": ["product"]}, {"url": "https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec", "tags": ["patch"]}, {"url": "https://github.com/hapijs/joi/pull/3164", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr", "tags": ["related", "vendor-advisory"], "name": "GitHub Security Advisory (GHSA-6w3j-5fw6-r9vr)"}, {"url": "https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67", "tags": ["technical-description"]}, {"name": "VulnCheck Advisory: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key"}], "credits": [{"lang": "en", "value": "Zachariah Mithani (AploSec)", "type": "finder"}, {"lang": "en", "value": "Marsup", "type": "remediation developer"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-05T19:39:47.724527Z", "id": "CVE-2026-122131", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:40:15.094Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-122131", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T19:39:47.724527Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T19:40:08.944Z"}}], "cna": {"title": "Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key", "credits": [{"lang": "en", "type": "finder", "value": "Zachariah Mithani (AploSec)"}, {"lang": "en", "type": "remediation developer", "value": "Marsup"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "hapijs", "product": "joi", "versions": [{"status": "affected", "version": "17.13.6", "lessThan": "17.13.9", "versionType": "semver"}, {"status": "affected", "version": "18.2.5", "lessThan": "18.3.1", "versionType": "semver"}], "packageURL": "pkg:npm/joi", "defaultStatus": "unaffected"}], "datePublic": "2026-10-28T00:00:00.000Z", "references": [{"url": "https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/hapijs/joi", "tags": ["product"]}, {"url": "https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec", "tags": ["patch"]}, {"url": "https://github.com/hapijs/joi/pull/3164", "tags": ["patch", "issue-tracking"]}, {"url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr", "name": "GitHub Security Advisory (GHSA-6w3j-5fw6-r9vr)", "tags": ["related", "vendor-advisory"]}, {"url": "https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67", "tags": ["technical-description"]}, {"url": "https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key", "name": "VulnCheck Advisory: Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 Prototype Replacement via __proto__ Language Key", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-04T20:36:51.069Z"}}}, "cveMetadata": {"cveId": "CVE-2026-122131", "state": "PUBLISHED", "dateUpdated": "2026-11-05T19:40:15.094Z", "dateReserved": "2026-11-04T18:13:10.837Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-11-04T20:36:51.069Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/joi", "product": "joi", "vendor": "hapijs", "versions": [{"lessThan": "17.13.9", "status": "affected", "version": "17.13.6", "versionType": "semver"}, {"lessThan": "18.3.1", "status": "affected", "version": "18.2.5", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic."}], "id": "CVE-2026-122131", "lastModified": "2026-11-12T21:30:23.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-122131", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T19:39:47.724527Z", "version": "2.0.3"}}]}, "published": "2026-11-04T21:18:08.710", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi/pull/3164"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "joi: joi: Prototype pollution via untrusted message configuration", "id": "2567736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2567736"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-915", "details": ["Joi 17.13.6 before 17.13.9 and 18.2.5 before 18.3.1 contains a prototype pollution vulnerability in lib/messages.js compile() and merge() that fails to reject a __proto__ language key. Attackers supplying untrusted message configuration via any().messages(), prefs, validate options or Joi.extend can replace the compiled messages prototype, altering or breaking validation error rendering and dependent logic.", "A flaw was found in joi. Applications that pass untrusted input into custom message configuration functions allow an attacker to cause prototype pollution, where shared base object properties in the runtime environment are improperly altered. By supplying a specially crafted message configuration containing reserved object keys, an attacker can modify prototype properties, potentially disrupting application behavior and corrupting validation logic."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-122131", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana12.4", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.1", "product_name": "Red Hat Hardened Images"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "package_name": "grafana13.2", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-11-04T20:36:51Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-122131\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-122131\nhttps://github.com/hapijs/joi\nhttps://github.com/hapijs/joi/blob/v18.3.0/lib/messages.js#L64-L67\nhttps://github.com/hapijs/joi/commit/76f5771e1afe527cfda24be0e1a920ffa54888d6\nhttps://github.com/hapijs/joi/commit/dae9467cec27e787bfdea8b276595177d52d28ec\nhttps://github.com/hapijs/joi/pull/3164\nhttps://github.com/hapijs/joi/security/advisories/GHSA-6w3j-5fw6-r9vr\nhttps://www.vulncheck.com/advisories/joi-17.13.6-before-17.13.9-and-18.2.5-before-18.3.1-prototype-replacement-via-proto-language-key"], "statement": "This vulnerability is rated as Low severity because exploitation requires an application to pass untrusted user input directly into internal schema configuration options rather than the validated payload itself. In typical Red Hat deployments and standard development practices, validation rules and message templates are statically defined by developers. As a result, the flaw is not reachable through standard validation flows, significantly limiting the practical attack surface.", "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[17.13.6,17.13.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[18.2.5,18.3.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "joi", "source": "cna", "vendor": "hapijs"}, "product": "joi", "vendor": "hapijs"}], "created": "2026-11-04T21:45:14.732888+00:00", "updated": "2026-11-06T14:00:07.365149+00:00", "vendors": ["hapijs", "hapijs$PRODUCT$joi"], "weaknesses": ["CWE-1321", "CWE-915"]}