CVE-2026-48038

About vulnerability

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

Affected product:

Node.js , React , b4a , babel-preset-expo , bare-fs , bare-stream , cli , db0 , devtools , drizzle-orm , expo , expo-asset , expo-constants , expo-file-system , expo-linking , expo-modules-jsi , expo-router , expo-sqlite , expo-symbols , expo-widgets , joi , jpm , jsonwebtoken , masked-view , metro-runtime , nitro , nuxt , op-sqlite , sign-addon , streamx , tar-stream , teex , text-decoder , unstorage , vite , vite-dev-rpc , vite-hot-client , vite-plugin-checker , vite-plugin-inspect , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer

Affected packages:

@react-native-community/cli-doctor @ 20.1.3 (+143 more)