fix(deps): update dependency joi to v17 [security] by renovate[bot] · Pull Request #97 · Trasebe/lblod-services

renovate · 2026-08-26T11:38:29Z

This PR contains the following updates:

Package	Change	Age	Confidence
joi	`^14.3.1` → `^17.0.0`
joi	`^14.3.1` → `^17.13.4`

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas

CVE-2026-48038 / GHSA-q7cg-457f-vx79

More information

Details

Impact

Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.

The blast radius depends on how the application invokes joi:

Highest impact: validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
Lower impact: validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.

Patches

Upgrade to version >= 18.2.1.

Workarounds

Try/catch the validation to avoid uncaught exceptions.

References

Pull request: fix: protect link recursion from max call stack hapijs/joi#3113

Severity

CVSS Score: 5.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

hapijs/joi (joi)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate Bot added the Renovate 🌴 label Aug 26, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 65c8420 to 27bcc19 Compare August 26, 2026 22:06

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Aug 26, 2026

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 2, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch 2 times, most recently from e9ea883 to 0e08a50 Compare September 3, 2026 01:10

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 3, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 0e08a50 to 1f30775 Compare September 3, 2026 09:36

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 3, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 1f30775 to 270ceba Compare September 4, 2026 03:11

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 4, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 270ceba to cb6d259 Compare September 7, 2026 22:31

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 7, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from cb6d259 to 8f0b865 Compare September 8, 2026 03:40

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 8, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 8f0b865 to d1c8113 Compare September 9, 2026 22:57

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 9, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d1c8113 to ab18e03 Compare September 10, 2026 03:30

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 10, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from ab18e03 to 0a799c4 Compare September 10, 2026 15:44

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 10, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 0a799c4 to 899bfb1 Compare September 10, 2026 23:47

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 10, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 899bfb1 to a1a7f65 Compare September 15, 2026 18:12

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 15, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from a1a7f65 to 17da8f8 Compare September 16, 2026 00:39

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 16, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 17da8f8 to d82f323 Compare September 16, 2026 13:13

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 16, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d82f323 to c7c1b6d Compare September 17, 2026 03:50

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 17, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from c7c1b6d to eec994d Compare September 17, 2026 19:07

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 17, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from eec994d to 05ebca1 Compare September 17, 2026 23:49

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 17, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 05ebca1 to db44034 Compare September 18, 2026 18:52

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 18, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from db44034 to d3c8cc7 Compare September 19, 2026 01:13

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 19, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d3c8cc7 to d80fc60 Compare September 23, 2026 20:43

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 23, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d80fc60 to b40ae14 Compare September 24, 2026 06:07

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 24, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from b40ae14 to d63cfbf Compare September 25, 2026 04:28

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Sep 25, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d63cfbf to 8767cd5 Compare September 25, 2026 18:03

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Sep 25, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 8767cd5 to a0d7f3a Compare October 1, 2026 10:56

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Oct 1, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from a0d7f3a to 0b98ad6 Compare October 1, 2026 18:41

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Oct 1, 2026

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from 0b98ad6 to d041850 Compare October 5, 2026 18:40

renovate Bot changed the title ~~fix(deps): update dependency joi to v17 [security]~~ fix(deps): update dependency joi [security] Oct 5, 2026

fix(deps): update dependency joi to v17 [security]

773b071

renovate Bot force-pushed the renovate/npm-joi-vulnerability branch from d041850 to 773b071 Compare October 5, 2026 21:56

renovate Bot changed the title ~~fix(deps): update dependency joi [security]~~ fix(deps): update dependency joi to v17 [security] Oct 5, 2026

Navigation Menu

Repository navigation

fix(deps): update dependency joi to v17 [security] - #97

fix(deps): update dependency joi to v17 [security]#97
renovate[bot] wants to merge 1 commit into
developfrom
renovate/npm-joi-vulnerability

renovate Bot commented Aug 26, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

joi has an uncaught RangeError on deeply nested input through recursive link() schemas

Details

Impact

Patches

Workarounds

References

Severity

References

Release Notes

Configuration

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 26, 2026 •

edited

Loading

joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas