Update dependency joi to v17.13.4 [SECURITY]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
joi	17.13.3 → 17.13.4

---

joi has an uncaught RangeError on deeply nested input through recursive link() schemas

CVE-2026-48038 / GHSA-q7cg-457f-vx79

More information

Details

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
• Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References

• Pull request: fix: protect link recursion from max call stack hapijs/joi#3113

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79
• https://github.com/hapijs/joi/pull/3113
• https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
• https://github.com/advisories/GHSA-q7cg-457f-vx79

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

joi has an uncaught RangeError on deeply nested input through recursive link() schemas

CVE-2026-48038 / GHSA-q7cg-457f-vx79

More information

Details

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

• Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
• Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References

• Pull request: fix: protect link recursion from max call stack hapijs/joi#3113

Severity

• CVSS Score: 5.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

• https://github.com/hapijs/joi/security/advisories/GHSA-q7cg-457f-vx79
• https://github.com/hapijs/joi/pull/3113
• https://github.com/hapijs/joi/commit/2392713d3e9dd91ba752ac0c96e0eaf3d24b9a11
• https://github.com/hapijs/joi

This data is provided by OSV and the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

hapijs/joi (joi)

v17.13.4

Compare Source

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • Monday through Friday (* * * * 1-5)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8c2195c

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR