{"id":"CVE-2026-118772","aliases":["GHSA-4528-x5fx-h6hg"],"title":"joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service","titleSource":"GitHub_M","descriptionSource":"OSV","declaredSeverity":"HIGH","description":"### Summary\n\n`Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service.\n\n### Details\n\nWhen the `multiple` option is set, the `email` rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator:\n\n```js\nconst regex = new RegExp(`\\\\s*[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`);\n// ...\nconst emails = options.multiple ? value.split(regex) : [value];\n```\n\n`String.prototype.split` tries a match at each position of the value. At each position inside a whitespace run, the leading `\\s*` reads the rest of the run, does not find a separator, and backtracks through all of it. A run of `n` whitespace characters without a separator therefore costs `n²` steps. This applies to the default separator and to all custom `separator` values.\n\nThe fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear:\n\n```js\nconst regex = new RegExp(`(?:(?<!\\\\s)\\\\s+)?[${options.separator ? escapeRegex(options.separator) : ','}]\\\\s*`);\n```\n\nThe split results do not change. The regular expression is now built only when `multiple` is set.\n\nEvery `joi` release from `17.1.1` up to and including `17.13.8`, and from `18.0.0` up to and including `18.3.0`, is affected. Every `@hapi/joi` release from `16.0.0` is affected.\n\nWorkarounds for users who cannot upgrade:\n\n- Add `.max()` before `.email()`, for example `Joi.string().max(1000).email({ multiple: true })`. The `max` rule then rejects long values before the `email` rule runs.\n- Do not use the `abortEarly: false` option with this schema. With `abortEarly: false`, the `email` rule runs even when the `max` rule fails.\n- Do not use `.trim()` as a workaround. It removes only the whitespace at the start and at the end of the value.\n\n### Proof of concept\n\n```js\nconst Joi = require('joi');\n\nconst schema = Joi.string().email({ multiple: true });\nfor (const n of [25000, 50000, 100000, 200000]) {\n    const start = Date.now();\n    schema.validate(' '.repeat(n));\n    console.log(`${n} spaces: ${Date.now() - start} ms`);\n}\n```\n\nOutput on `joi@18.3.0` (Node.js 26):\n\n```text\n25000 spaces: 244 ms\n50000 spaces: 887 ms\n100000 spaces: 3349 ms\n200000 spaces: 13579 ms\n```\n\nOutput on the patched version:\n\n```text\n25000 spaces: 0 ms\n50000 spaces: 0 ms\n100000 spaces: 0 ms\n200000 spaces: 1 ms\n```\n\nOver HTTP, send the whitespace in a field that the route validates with this schema:\n\n```http\nPOST /invite HTTP/1.1\nContent-Type: application/json\n\n{\"emails\": \"<100000 spaces>\"}\n```\n\n### Impact\n\nThis is a denial of service by CPU exhaustion. It affects each application that validates untrusted input with `Joi.string().email({ multiple: true })` and that has no length limit before the `email` rule. One request with 100 KB of whitespace blocks the Node.js event loop for several seconds, and the server cannot process other requests during that time. The attacker needs no authentication when the route is public, and a small number of concurrent requests can keep the service unavailable.","severity":"high","score":7.5,"published":"2026-10-29T18:13:33.771Z","modified":"2026-10-30T23:15:07.273Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"joi","sources":[{"name":"OSV · GHSA-4528-x5fx-h6hg","url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}],"ranges":[{"events":[{"introduced":"17.1.1"},{"fixed":"17.13.9"}],"type":"SEMVER"}],"versions":[],"fixed":["17.13.9"]},{"ecosystem":"npm","name":"@hapi/joi","sources":[{"name":"OSV · GHSA-4528-x5fx-h6hg","url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}],"ranges":[{"events":[{"introduced":"16.0.0"},{"last_affected":"17.1.1"}],"type":"SEMVER"}],"versions":[],"fixed":[]},{"ecosystem":"npm","name":"joi","sources":[{"name":"OSV · GHSA-4528-x5fx-h6hg","url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}],"ranges":[{"events":[{"introduced":"18.0.0"},{"fixed":"18.3.1"}],"type":"SEMVER"}],"versions":[],"fixed":["18.3.1"]}],"sourceAffected":[],"references":["https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","https://github.com/hapijs/joi/pull/3162","https://github.com/hapijs/joi/pull/3163","https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","https://github.com/hapijs/joi/releases/tag/v17.13.9","https://github.com/hapijs/joi/releases/tag/v18.3.1","https://nvd.nist.gov/vuln/detail/CVE-2026-118772","https://github.com/hapijs/joi"],"sources":[{"name":"CVE","id":"CVE-2026-118772","modified":"2026-10-29T18:13:33.771Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-118772"},{"name":"OSV","id":"GHSA-4528-x5fx-h6hg","modified":"2026-10-30T23:15:07.273035332Z","url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}],"assessments":[{"source":"GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5},{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5}],"cve":{"records":[{"id":"CVE-2026-118772","source":"GitHub_M","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-10-28T19:20:05.018Z","published":"2026-10-29T18:13:33.771Z","modified":"2026-10-29T18:13:33.771Z"}],"publishers":[{"name":"GitHub_M","role":"CNA","organizationId":"a0819718-46f1-4df5-94e2-005712e83aaa","modified":"2026-10-29T18:13:33.771Z"}],"references":[{"url":"https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg","tags":["x_refsource_CONFIRM"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/pull/3162","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/pull/3163","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/commit/03dc1d909818503b06240dadc81e9227ed2649cf","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/commit/807858d7480f5075b0610817e3e44230890fb18e","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/releases/tag/v17.13.9","tags":["x_refsource_MISC"],"source":"GitHub_M"},{"url":"https://github.com/hapijs/joi/releases/tag/v18.3.1","tags":["x_refsource_MISC"],"source":"GitHub_M"}],"weaknesses":[{"id":"CWE-1333","description":"CWE-1333: Inefficient Regular Expression Complexity","source":"GitHub_M"}],"applicability":[],"prioritization":[]},"products":[{"vendor":"hapijs","name":"joi","platforms":[],"versions":[{"version":">= 16.0.0, <= 17.1.1","status":"affected"},{"version":">= 18.0.0, < 18.3.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118772"},{"vendor":"@hapi","name":"joi","platforms":[],"versions":[{"version":">= 16.0.0, <= 17.1.1","status":"affected"}],"cpes":[],"source":"GitHub_M","url":"https://www.cve.org/CVERecord?id=CVE-2026-118772"}],"remediation":[],"observedAt":"2026-10-30T23:32:20.142Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T14:05:32.453Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-30T08:25:32.590Z","attemptedAt":"2026-10-30T08:25:32.590Z"},{"source":"GHSA","status":"no-result","checkedAt":"2026-10-30T08:25:32.746Z","attemptedAt":"2026-10-30T08:25:32.746Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-30T08:25:32.292Z","attemptedAt":"2026-10-30T08:25:32.292Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-30T08:25:32.152Z","attemptedAt":"2026-10-30T08:25:32.152Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-113320","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-113320","modified":"Oct 29, 2026, 6:13:33 PM","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T08:25:32.292Z"},{"source":"NVD","id":"CVE-2026-118772","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118772","modified":"2026-10-29T19:17:19.563","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","checkedAt":"2026-10-30T08:25:32.590Z"}],"aiSummary":{"text":"The `joi` package's `string().email({ multiple: true })` function has a quadratic-time split vulnerability, allowing a denial of service attack. Affected versions include `joi` releases from `17.1.1` to `17.13.8` and from `18.0.0` to `18.3.0`, as well as `@hapi/joi` releases from `16.0.0`. An attacker can cause CPU exhaustion with a single request containing a large amount of whitespace.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T00:01:54.115Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-118772"},{"name":"OSV","url":"https://osv.dev/vulnerability/GHSA-4528-x5fx-h6hg"}]}}