Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-92599 · Microsoft / collected KEV context

EUVD-2026-81299

GHSA-mrx9-2rrp-rhpx

GHSA-6h2x-m376-mqjq

cve-program · CVE-2026-92599

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate

euvd · EUVD-2026-81299

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate

nvd · CVE-2026-92599

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate

osv · GHSA-6h2x-m376-mqjq

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://nvd.nist.gov/vuln/detail/CVE-2026-92599
• https://github.com/hapijs/joi/pull/3143
• https://github.com/hapijs/joi/pull/3145
• https://github.com/hapijs/joi/commit/115e7b58d5eaaecc5e9b7093d41899ad6fb053ec
• https://github.com/hapijs/joi/commit/e70df424c367f2976db63b089504413744a21245
• https://github.com/hapijs/joi
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate

osv · GHSA-mrx9-2rrp-rhpx

• https://github.com/hapijs/joi/security/advisories/GHSA-6h2x-m376-mqjq
• https://nvd.nist.gov/vuln/detail/CVE-2026-92599
• https://www.vulncheck.com/advisories/joi-before-17.13.7-and-18.2.6-redos-via-isodate

• joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the … · Advisory content revised · 1 Nov 2026