The vulnerability originates from an untrapped exception when joi's validate() processes deeply nested JSON using recursive link() schemas. Prior to versions 17.13.4 and 18.2.1, calling validate() without surrounding it in a try/catch inside a request handler causes a RangeError that propagates unhandled, potentially crashing the Node.js process. Lower‑impact paths that use validateAsync() or wrap validate() in try/catch still raise a RangeError but return it as part of a ValidationError, preventing a crash. This failure to handle abnormal input gracefully (CWE‑248) leads to a denial‑of‑service, with no impact on confidentiality or integrity. The flaw is mitigated in the newer releases.

Applications that depend on hapijs joi prior to release 17.13.4 and 18.2.1 are affected. Any component that passes user-supplied JSON or object payloads to joi.validate() without proper error handling may be vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of <1% implies a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the crash by sending a deeply nested payload to any endpoint that uses joi.validate() directly; using validateAsync() or proper try/catch still raises a RangeError but does not crash the process, reducing practical impact.