CVE-2026-118772: Regular Expression Denial of Service in Joi Email Validation

Vulnerability ID: CVE-2026-118772

CVSS Score: 7.5

Published: 2026-10-30

A Regular Expression Denial of Service (ReDoS) vulnerability exists in the joi schema description and data validation library for JavaScript. When validating multiple email addresses using the Joi.string().email({ multiple: true }) configuration, the library compiles a separator regular expression with an unanchored greedy leading whitespace quantifier. Supplying an input string containing a long sequence of whitespace characters without the expected delimiter triggers quadratic time complexity during String.prototype.split execution, blocking the single-threaded Node.js event loop.

TL;DR

Joi versions prior to 17.13.9 and 18.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS) when validating multiple email addresses via Joi.string().email({ multiple: true }).…