< Back

CVE-2026-90771

Updated on 13 Sep 2026

Severity

6.3 Medium severity

Details

CVSS score
6.3
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE ID
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object’s prototype, breaking downstream code relying on Object.prototype methods.

Details

Affected product:
React , eas-cli , expo , expo-dev-tools , expo-electron-adapter , expo-expo-cli , expo-next-adapter , expo-webpack-config , expo-xdl , expo-yarn-workspaces , expo/eas-cli , gatsby , gatsby-interface , hapi-catbox , hapi-heavy , hapi-joi , hapi-podium , hapi-shot , hapi-statehood , joi , jsonwebtoken , simple-oauth2 , wait-on , workbox , xdl
Affected packages:
joi @ 6.10.1 (+132 more)

Fixes