Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Path to dependency file: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2026-48038
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Path to dependency file: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
- ❌ joi-17.13.3.tgz (Vulnerable Library)
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Publish Date: 2026-07-14
URL: CVE-2026-48038
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4
Step up your Open Source Security Game with Mend here
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Path to dependency file: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Vulnerable Library - joi-17.13.3.tgz
Library home page: https://registry.npmjs.org/joi/-/joi-17.13.3.tgz
Path to dependency file: /backend/package.json
Path to vulnerable library: /backend/node_modules/joi/package.json
Dependency Hierarchy:
Found in HEAD commit: 0f1cc4f79fdab9e4d90aa9caf963ea2e271c0183
Found in base branch: main
Vulnerability Details
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
Publish Date: 2026-07-14
URL: CVE-2026-48038
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
For more information on CVSS3 Scores, click here.Suggested Fix
Type: Upgrade version
Release Date: 2026-06-12
Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4
Step up your Open Source Security Game with Mend here