CVE-2026-48038 Details

A denial-of-service vulnerability has been identified in Joi, a popular JavaScript schema description and data validation library. This issue affects versions of Joi prior to 17.13.4 and 18.2.1. The vulnerability arises when services validate user-supplied JSON or object input using recursive link schemas. If the validate() function is called without a try/catch block in a request handler, deeply nested input can cause an unhandled RangeError, potentially crashing the process. Although lower-impact validation paths using validateAsync() or a try/catch block are available, they still result in a RangeError instead of a properly structured ValidationError, complicating error handling.

Upgrade to Joi version 17.13.4 or 18.2.1 or later. If immediate upgrading is not possible, wrap validation calls in a try/catch block to manage exceptions and prevent crashes.