CVE-2026-92599

The joi npm package (the hapi.js schema validation library) is vulnerable to regular expression denial of service (ReDoS, CWE-1333) in the Joi.string().isoDate() validation rule, because one of the regular expressions applied to input is unanchored. A remote attacker who can supply a string that reaches an isoDate() check can trigger quadratic backtracking by sending a valid ISO date followed by a long run of fractional-second digits, taking roughly 1.4 seconds per 64 KB of digits and about 22 seconds per 256 KB. With a single crafted request the attacker can stall the event loop or a request handler, degrading or denying service to the application. Any Node.js service using joi versions 17.2.0 up to (but not including) 18.2.6 that validates attacker-controlled strings with isoDate() is affected. Exploitation is not currently known in the wild, there is no public proof-of-concept, and the flaw is not on the CISA KEV list.

What to do: Upgrade joi to 17.13.7 if you are pinned to the 17.x line, or to 18.2.6 or later on the 18.x line. As a workaround, cap the length of any string (e.g., request-body or field-size limits) before it reaches joi's isoDate() validation. Search your codebase for Joi.string().isoDate() and confirm whether the validated input can be attacker-controlled.