{"id":"EUVD-2026-76992","enisaUuid":"1b4a6cff-f589-307d-b1ce-0d7cad685c0c","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods.","datePublished":"Sep 13, 2026, 10:45:42 AM","dateUpdated":"Sep 24, 2026, 2:21:52 PM","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/hapijs/joi/issues/3150\nhttps://github.com/hapijs/joi\nhttps://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js\nhttps://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb\nhttps://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages\n","aliases":"CVE-2026-90771\nGHSA-wr44-6hxh-3jwq\n","assigner":"VulnCheck","epss":0.39,"enisaIdProduct":[{"id":"a610894f-6964-3f42-9e64-11d12c261119","product":{"name":"joi","vendor":{"name":"hapijs"}},"product_version":"16.0.0 \u003c17.13.8"},{"id":"d5c7b601-da6a-3135-87cb-864646c3a02d","product":{"name":"joi","vendor":{"name":"hapijs"}},"product_version":"18.0.0 \u003c18.2.9"}],"enisaIdVendor":[{"id":"9ec09eb3-ae2b-3d63-80d8-fe51f26de1e5","vendor":{"name":"hapijs"}}],"enisaIdVulnerability":[{"id":"58262199-06d2-31d6-899c-87888f07c79a","vulnerability":{"id":"CVE-2026-90771","description":"joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object\u0027s prototype, breaking downstream code relying on Object.prototype methods.","datePublished":"Sep 13, 2026, 10:45:42 AM","dateUpdated":"Sep 24, 2026, 2:21:52 PM","status":"PUBLISHED","baseScore":6.3,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/hapijs/joi/issues/3150\nhttps://github.com/hapijs/joi\nhttps://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js\nhttps://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb\nhttps://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages\n","enisa_id":"EUVD-2026-76992\n","assigner":"VulnCheck","epss":0.39,"dataProcessed":"Nov 11, 2026, 7:25:14 AM","vulnerabilityProduct":[{"id":"16d31f75-4a48-3fa8-9eb3-ca032ef624b3","product":{"name":"joi","vendor":{"name":"hapijs"}},"product_version":"18.0.0 \u003c18.2.9"},{"id":"fc3347d5-a22d-3afe-8fa6-668acbb68f88","product":{"name":"joi","vendor":{"name":"hapijs"}},"product_version":"16.0.0 \u003c17.13.8"}],"vulnerabilityVendor":[{"id":"978a9933-610f-3560-b84f-0c8e3113adb0","vendor":{"name":"hapijs"}}]}},{"id":"6b8c1f72-d916-37d6-af91-5bd27e17df42","vulnerability":{"id":"GHSA-wr44-6hxh-3jwq","description":"joi messages compilation allows prototype replacement through __proto__ error codes","datePublished":"Sep 13, 2026, 12:31:12 PM","dateUpdated":"Oct 5, 2026, 11:29:52 PM","baseScore":0.0,"references":"https://nvd.nist.gov/vuln/detail/CVE-2026-90771\nhttps://github.com/hapijs/joi/issues/3150\nhttps://github.com/hapijs/joi/pull/3151\nhttps://github.com/hapijs/joi/pull/3153\nhttps://github.com/hapijs/joi/commit/1d2001cad9971327a62c9fd8eb1afec20cd784d2\nhttps://github.com/hapijs/joi/commit/5b8333c9177e08b4ef4ed02903c2d657084e7afb\nhttps://github.com/hapijs/joi\nhttps://github.com/hapijs/joi/blob/v18.2.8/lib/messages.js\nhttps://github.com/hapijs/joi/releases/tag/v17.13.8\nhttps://github.com/hapijs/joi/releases/tag/v18.2.9\nhttps://www.vulncheck.com/advisories/joi-before-17.13.8-and-18.2.9-prototype-pollution-via-messages\n","enisa_id":"EUVD-2026-76992\n","aliases":"GHSA-wr44-6hxh-3jwq\nCVE-2026-90771\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:53:05 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[{"id":"0b3a7da3-da98-327f-aad3-13aab6d27a5d","advisory":{"id":"RHSA-2026:67610","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 15, 2026, 2:47:44 PM","dateUpdated":"Nov 7, 2026, 5:51:19 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:67610\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67610.json\n","aliases":"CVE-2026-90771\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"1ac3e7ce-f584-3598-bad6-ff9229ddde0a","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"5bdb72e8-3ddd-39c0-ba67-74469d67e691","product":{"name":"grafana12.4-0:12.4.10-0.3.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"638142c5-02c2-3e57-9fbb-bf9d31c8ffcd","product":{"name":"grafana12.4-0:12.4.10-0.3.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"81a4a93d-d475-38ca-b1fd-9bcd146114af","product":{"name":"grafana12.4-0:12.4.10-0.3.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}},{"id":"2ec5ad01-cdfd-34a3-acb7-e6e1952c10fe","advisory":{"id":"RHSA-2026:67573","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 15, 2026, 2:19:34 PM","dateUpdated":"Nov 7, 2026, 11:45:46 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:67573\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67573.json\n","aliases":"CVE-2026-9029\nCVE-2026-10601\nCVE-2026-75838\nCVE-2026-90771\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"207d4e7b-7044-3202-bafc-ff312719eeec","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"41057ed4-db60-3582-86a2-cf1e0316deba","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"938ec239-a7a6-37d5-8c2c-4f7e4aef0ece","product":{"name":"grafana13.1-0:13.1.3-0.9.hum1@x86_64","vendor":{"name":"Red Hat"}}},{"id":"ce9dc593-3f14-326e-93bf-c52ca21be0bc","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}}]}},{"id":"487faf94-f105-3204-8d2e-5d1ce4e960d4","advisory":{"id":"RHSA-2026:67605","description":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","summary":"An update for Red Hat Hardened Images RPMs is now available.","datePublished":"Sep 15, 2026, 2:39:47 PM","dateUpdated":"Nov 7, 2026, 5:51:18 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:67605\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_67605.json\n","aliases":"CVE-2026-9029\nCVE-2026-10601\nCVE-2026-61709\nCVE-2026-90771\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"70affe73-152c-34fd-98ab-df94e7ed21d1","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@src","vendor":{"name":"Red Hat"}}},{"id":"c1a7aab4-cb18-3bed-91ad-71660f08d206","product":{"name":"Red Hat Hardened Images","vendor":{"name":"Red Hat"}}},{"id":"d353b9ba-fa4b-3e79-b709-8dc5ff9c16ed","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@aarch64","vendor":{"name":"Red Hat"}}},{"id":"dd0bdc38-80ed-3c6f-bd1e-577f22159d9b","product":{"name":"grafana13.2-0:13.2.1-0.4.hum1@x86_64","vendor":{"name":"Red Hat"}}}]}}]}