The vulnerability arises from prototype pollution in the lib/messages.js module of the joi validation library. When an attacker can supply an untrusted language key named __proto__ or constructor through messages(), message(), prefs({messages}), Joi.extend({messages}), or rule({message}), the library writes properties onto Object.prototype or static properties on the Object constructor. This flaw is a classic Prototype Pollution weakness (CWE‑1321, CWE‑915) that can cause all objects in the process to inherit unexpected properties, potentially leading to unpredictable behaviour or bypasses in application logic. The impact is limited to objects affected by the polluted prototype, without enabling direct code execution, but can subvert flow control or introduce other subtle bugs.

Vulnerable to usage of hapijs joi @hapi/joi versions 16.0.0‑17.13.6 and the successor joi package 18.0.0‑18.2.5. No patch is available for @hapi/joi; the fix is included in joi 17.13.6 and 18.2.5.

The flaw poses a low CVSS risk (3.7) and has an EPSS score of 0.00255. The exploitation requires that an attacker can inject untrusted input into the schema construction process, typically through dynamic configuration of messages() or similar APIs. Once achieved, prototype pollution can affect every object inspected by the application, potentially breaking control flow or exposing other vulnerabilities (CWE‑1321, CWE‑915). The vulnerability is not currently in CISA’s KEV catalog and has an EPSS score of 0.00255, indicating a very low probability of exploitation but still relevant to systems exposing schema construction to untrusted data.