Skip to content
Fencer Vulns
high 7.5

CVE-2026-92599 json

Joi before 17.13.7 and 18.2.6 ReDoS via isoDate

published 2026-09-16 53 d ago modified 2026-10-05 34 d ago also GHSA-6h2x-m376-mqjq , EUVD-2026-81299

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

joi (npm package `joi`, hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the `Joi.string().isoDate()` validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.

Patch / fix

  • npm joi 17.13.7, 18.2.6
  • hapijs joi 17.13.7, 18.2.6
  • grafana13.1 hummingbird 1 13.1.6-0.2.hum1
  • grafana12.4 hummingbird 1 12.4.10-0.6.hum1
  • grafana13.2 hummingbird 1 13.2.1-0.5.hum1

red hat advisories RHSA-2026:68926RHSA-2026:68821RHSA-2026:68778

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-92599 updated cvss 7.5

joi: joi: Denial of Service via `isoDate` validation regular expression

  • Red Hat Data Grid 8 redhat-datagrid-maven-repository.zip 8.6.1.CR1
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Enterprise Linux 8 grafana-pcp Red Hat OpenShift Container Platform 4 openshift4/ose-agent-installer-ui-rhel9
    affected: workaround, no fix available
  • Red Hat Hardened Images grafana13.1 13.1.6-0.2.hum1, grafana13.2 13.2.1-0.5.hum1, grafana12.4 12.4.10-0.6.hum1
    fixed: vendor fix RHSA-2026:68821
  • Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-ui-rhel8 1791853281
    fixed: vendor fix RHSA-2026:85846
  • Red Hat OpenShift AI 2.25 rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-mod-arch-model-registry-rhel9 1791853432
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-dashboard-rhel9 1793001801, rhoai/odh-mod-arch-maas-rhel9 1793001859, rhoai/odh-mod-arch-automl-rhel9 1793001841, rhoai/odh-mod-arch-gen-ai-rhel9 1793001896, rhoai/odh-mod-arch-mlflow-rhel9 1793001851, rhoai/odh-mod-arch-autorag-rhel9 1793001850, +2 more
    fixed: vendor fix RHSA-2026:92510
  • Red Hat Gatekeeper 3 redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-19/gatekeeper-3-19
    not affected: component not present
  • Red Hat Enterprise Linux 8 grafana, grafana-loki, grafana-mssql, grafana-mysql, grafana-selinux, grafana-graphite, +9 more
    not affected: vulnerable code not present
show 2 more
  • Red Hat Enterprise Linux 9 grafana, grafana-selinux, grafana 12.4.3-2.el10
    not affected: vulnerable code not in execute path
  • Red Hat Enterprise Linux 10 grafana 12.4.3-2.el10 Red Hat Migration Toolkit 1.8 rhmtc/openshift-migration-openvpn-rhel8 1792066862, rhmtc/openshift-migration-registry-rhel8 1791983931, rhmtc/openshift-migration-rhel8-operator 1792066855, rhmtc/openshift-migration-operator-bundle 1792067362, rhmtc/openshift-migration-controller-rhel8 1791987924, rhmtc/openshift-migration-log-reader-rhel8 1791854351, +4 more Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, rhoai/odh-vllm-rocm-rhel9 1791282503, +64 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1792697253, rhoai/odh-mlflow-rhel9 1793002327, rhoai/odh-autorag-rhel9 1793265800, rhoai/odh-trainer-rhel9 1792817113, +92 more Red Hat OpenShift Container Platform 5 openshift5/ose-agent-installer-ui-rhel9 Red Hat OpenShift Dev Spaces devspaces/dashboard-rhel9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
51 d ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
npm joi
>=17.2.0, <17.13.7
>=18.0.0, <18.2.6
17.13.7
18.2.6

Affected products

  • hapijs joi

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.