CVE-2026-122131 | hapijs Joi up to 17.13.8/18.3.0 Message Compilation lib/messages.js compile/merge prototype pollution

A vulnerability classified as critical was found in hapijs Joi up to 17.13.8/18.3.0. This vulnerability affects the function compile/merge of the file lib/messages.js of the component Message Compilation. The manipulation results in improperly controlled modification of object prototype attributes.

This vulnerability is cataloged as CVE-2026-122131. The attack may be launched remotely. There is no exploit available.

Upgrading the affected component is advised.VulDB Recent EntriesRead More