Zero Radar
← feed
HighVulnerabilityCVE-2026-118772updated 30 Oct 2026, 23:10 UTC

Joi email validator can freeze Node.js servers on long whitespace input

A single crafted request with a very long run of spaces can make a Node.js server stop responding for several seconds. Other users' requests wait during that time.

Fixed in joi 17.13.9 and joi 18.3.1 · out Official, 2 sources
SeverityHighCVSS 7.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yesjoi 17.13.9 and joi 18.3.1 · since 30 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker sends requestBody has about 100 KB of spaces
  2. 2Route validates fieldUses email with multiple option
  3. 3Regex backtracksQuadratic time on whitespace run
  4. 4Event loop blockedNode.js cannot handle other requests
  5. ResultServer stops responding for seconds

What happened

Joi's string().email({ multiple: true }) rule splits input with a regular expression whose leading whitespace quantifier backtracks quadratically over long whitespace runs, blocking the Node.js event loop (ReDoS-style CPU exhaustion).

Why it is dangerous: Any internet-facing app that validates user-supplied multi-address email fields with this rule and has no earlier length limit can be taken down or slowed heavily by one request.

Are you affected?

You are affected if your app uses Joi (17.1.1 to before 17.13.9, or 18.0.0 to before 18.3.1) or @hapi/joi 16.0.0 and later, and validates untrusted input with Joi.string().email({ multiple: true }).

Package / productAffected versionsFixed in
joi · npm>= 17.1.1, < 17.13.917.13.9
@hapi/joi · npm>= 16.0.0, <= 17.1.1no fix yet
joi · npm>= 18.0.0, < 18.3.118.3.1

What to do

  1. Update joi to 17.13.9 (for the 17.x line) or 18.3.1 (for the 18.x line)
  2. If you use @hapi/joi, check for a fixed release; none is named in the advisory, so add a length limit as a workaround
  3. Until patched, add .max(1000) before .email({ multiple: true }) and avoid abortEarly: false on that schema

Timeline

  1. 29 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 29 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 29 Oct 2026, 19:21 UTC
    Picked up by Zero Radar
  4. 30 Oct 2026, 23:10 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 30 Oct 2026, 23:10 UTC
    Fixed version published: joi 17.13.9, joi 18.3.1 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118772 · GHSA-4528-x5fx-h6hg
CVSS
7.5 / 10
Disclosed
29 Oct 2026, 19:17 UTC
On Zero Radar
29 Oct 2026, 19:21 UTC (4 min after disclosure)
Last change
30 Oct 2026, 23:10 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Joi email validator can freeze Node.js servers on long whitespace input · Zero Radar