ZDF
Sign inSign up

Vulnerabilities

Security fix · CVE-2026-118772

joi: quadratic-time split in allows denial of service

Published Oct 30, 2026 · catalog updated Oct 30, 2026 · joi: quadratic-time split in

Last checked Nov 4, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118772. EPSS is 0.47%. Act only if a listed version of joi: quadratic-time split in is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (joi: quadratic-time split in).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.47%
Remediation
Version ranges on file
Affected products
npm @hapi · npm @hapi/joi · npm joi

### Summary takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the option is set, the rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: tries a match at each position of the value. At each position inside a whitespace run, the leading reads the rest of the run, does not find a separator, and backtracks through all of it. A run of whitespace characters without a separator therefore costs steps. This applies to the default separator and to all custom values. The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear: The split results do not change. The regular expression is now built only when is set. Every release from up to and including , and from up to and including , is affected. Every release from is affected. Workarounds for users who cannot upgrade: - Add before , for example . The rule then rejects long values before the rule runs. - Do not use the option with this schema. With , the rule runs even when the rule fails. - Do not use as a workaround. It removes only the whitespace at the start and at the end of the value. ### Proof of concept Output on (Node.js 26): Output on the patched version: Over HTTP, send the whitespace in a field that the route validates with this schema: ### Impact This is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with and that has no length limit before the rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm @hapiversion unspecified
  • npm @hapi/joi>= 16.0.0, <= 17.1.1
  • npm @hapi/joi>=16.0.0 <=17.1.1
  • npm joi>= 17.1.1, < 17.13.9
  • npm joi>= 18.0.0, < 18.3.1

How to fix CVE-2026-118772

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-118772. EPSS is 0.47%. Act only if a listed version of joi: quadratic-time split in is installed.

Which versions are affected?

Compare what you have installed with >= 16.0.0, <= 17.1.1, >=16.0.0 <=17.1.1, >= 17.1.1, < 17.13.9, >= 18.0.0, < 18.3.1. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-1333: Inefficient Regular Expression Complexity. EPSS 0.47%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 30, 2026 · GitHub Advisory Database

    Detected

    ### Summary takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the option is set, the rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: tries a match at each position of

  2. Oct 30, 2026 · GitHub Advisory Database

    Updated

    ### Summary takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the option is set, the rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: tries a match at each position of

Sources

  • CVE.orgVulnerability recordCVE-2026-118772

    Official CVE identifier

    cve.org
  • GitHub Advisory DatabasePackage advisoryGHSA-4528-x5fx-h6hg

    joi: quadratic-time split in allows denial of service

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-118772

    Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.

    advisories.gitlab.com
  • GitLab Advisory DatabasePackage advisorynpm/@hapi/joi/CVE-2026-118772.yml

    takes quadratic time to split + a value that contains a long run of whitespace. One request with 100 KB of spaces + blocks the Node.js event loop for several seconds, which causes a denial of service." +date: "2026-10-30" +pubdate: "2026-10-30" +affected_range: ">=16.0.0 <=17.1.1" +fixed_versions: [] +affected_versions: "All versions starting from 16.0.0 up to 17.1.1" +not_impacted: "" +solution:

    gitlab.com

References

Freshness

Last verified in this catalog Nov 3, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseNov 4, 2026
  • GitLab Advisory DatabaseNov 3, 2026
  • GitLab Advisory DatabaseNov 1, 2026
  • CVE.orgOct 31, 2026