Skip to content

nexmo-client-9.1.4.tgz: 13 vulnerabilities (highest severity is: 10.0) #45

Open
Open
nexmo-client-9.1.4.tgz: 13 vulnerabilities (highest severity is: 10.0)#45
Labels
Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

Description

@mend-for-github-com
mend-for-github-com
bot
opened on Feb 9, 2023
Vulnerable Library - nexmo-client-9.1.4.tgz

Sample Path to Dependency File: /app-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Vulnerabilities

Vulnerability Severity CVSS Dependency Type Fixed in (nexmo-client version) Remediation Possible**
CVE-2022-2421 Critical 10.0 socket.io-parser-3.3.2.tgz Transitive N/A* ❌
CVE-2026-41907 Critical 9.8 uuid-3.4.0.tgz Transitive N/A* ❌
CVE-2026-92599 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-69185 High 7.5 socket.io-parser-3.3.2.tgz Transitive N/A* ❌
CVE-2026-48779 High 7.5 ws-7.4.6.tgz Transitive N/A* ❌
CVE-2026-33151 High 7.5 socket.io-parser-3.3.2.tgz Transitive N/A* ❌
CVE-2024-37890 High 7.5 ws-7.4.6.tgz Transitive 9.1.5 ✅
CVE-2023-32695 High 7.3 socket.io-parser-3.3.2.tgz Transitive N/A* ❌
CVE-2023-25166 Medium 5.5 formula-3.0.0.tgz Transitive N/A* ❌
CVE-2026-48038 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-90771 Low 3.7 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-84368 Low 3.7 detected in multiple dependencies Transitive N/A* ❌
CVE-2026-84367 Low 3.7 detected in multiple dependencies Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-2421

Vulnerable Library - socket.io-parser-3.3.2.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.2.tgz

Sample Path to Dependency File: /app-to-app-js/package.json

Path to vulnerable library: /app-to-app-js/node_modules/socket.io-parser/package.json,/app-to-phone-js/node_modules/socket.io-parser/package.json,/phone-to-app-js/node_modules/socket.io-parser/package.json,/in-app-messaging-js/node_modules/socket.io-parser/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • ❌ socket.io-parser-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

Due to improper type validation in attachment parsing the Socket.io js library, it is possible to overwrite the _placeholder object which allows an attacker to place references to functions at arbitrary places in the resulting query object.

Publish Date: 2022-10-25

URL: CVE-2022-2421

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qm95-pgcg-qqfq

Release Date: 2022-10-25

Fix Resolution: socket.io-parser - 3.3.3,socket.io-parser - 4.2.1,socket.io-parser - 4.0.5,socket.io-parser - 3.4.2

CVE-2026-41907

Vulnerable Library - uuid-3.4.0.tgz

RFC4122 (v1, v4, and v5) UUIDs

Library home page: https://registry.npmjs.org/uuid/-/uuid-3.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/uuid/package.json,/app-to-phone-js/node_modules/uuid/package.json,/app-to-app-js/node_modules/uuid/package.json,/phone-to-app-js/node_modules/uuid/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • ❌ uuid-3.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

uuid is for the creation of RFC9562 (formerly RFC4122) UUIDs. Prior to 14.0.0, v3, v5, and v6 accept external output buffers but do not reject out-of-range writes (small buf or large offset). This allows silent partial writes into caller-provided buffers. This vulnerability is fixed in 14.0.0.

Publish Date: 2026-04-24

URL: CVE-2026-41907

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w5hq-g745-h8pq

Release Date: 2026-04-24

Fix Resolution: https://github.com/uuidjs/uuid.git - v11.1.1,https://github.com/uuidjs/uuid.git - v12.0.1,https://github.com/uuidjs/uuid.git - v13.0.1

CVE-2026-92599

Vulnerable Libraries - joi-17.6.3.tgz, joi-17.4.0.tgz

joi-17.6.3.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.6.3.tgz

Sample Path to Dependency File: /phone-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.6.3.tgz (Vulnerable Library)

joi-17.4.0.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

joi (npm package "joi", hapi.js) versions >=17.2.0 <17.13.7 and >=18.0.0 <18.2.6 are vulnerable to regular expression denial of service in the "Joi.string().isoDate()" validation rule. One of the regular expressions the rule applies to the input is unanchored, so a valid ISO date followed by a long run of fractional-second digits causes the regex engine to restart its search from every position in the string, yielding time proportional to the square of the input length (about 1.4 s for 64 KB of digits and about 22 s for 256 KB). A remote attacker who can supply a string to an isoDate validation can stall the application with a single request. Fixed in 17.13.7 and 18.2.6; as a workaround, cap the length of the string before it reaches joi.

Publish Date: 2026-09-16

URL: CVE-2026-92599

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-16

Fix Resolution: https://github.com/hapijs/joi.git - v17.13.7,https://github.com/hapijs/joi.git - v18.2.6,joi - 17.13.7,joi - 18.2.6

CVE-2026-69185

Vulnerable Library - socket.io-parser-3.3.2.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.2.tgz

Sample Path to Dependency File: /app-to-app-js/package.json

Path to vulnerable library: /app-to-app-js/node_modules/socket.io-parser/package.json,/app-to-phone-js/node_modules/socket.io-parser/package.json,/phone-to-app-js/node_modules/socket.io-parser/package.json,/in-app-messaging-js/node_modules/socket.io-parser/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • ❌ socket.io-parser-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

Socket.IO enables bidirectional and low-latency communication for every platform. Prior to 4.2.7, 3.4.5, and 3.3.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This vulnerability is fixed in 4.2.7, 3.4.5, and 3.3.6.

Publish Date: 2026-08-03

URL: CVE-2026-69185

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-08-03

Fix Resolution: https://github.com/socketio/socket.io.git - socket.io-parser@4.2.7,https://github.com/socketio/socket.io.git - socket.io-parser@3.4.5,https://github.com/socketio/socket.io.git - socket.io-parser@3.3.6

CVE-2026-48779

Vulnerable Library - ws-7.4.6.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.6.tgz

Sample Path to Dependency File: /app-to-phone-js/package.json

Path to vulnerable library: /app-to-phone-js/node_modules/ws/package.json,/in-app-messaging-js/node_modules/ws/package.json,/phone-to-app-js/node_modules/ws/package.json,/app-to-app-js/node_modules/ws/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • engine.io-client-3.5.3.tgz
        • ❌ ws-7.4.6.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. All versions from 1.1.0 up to (but not including) 5.2.5, from 6.0.0 up to 6.2.4, from 7.0.0 up to 7.5.11, and from 8.0.0 up to 8.21.0 are affected by a memory exhaustion DoS vulnerability. A peer can send a high volume of exceptionally small fragments and data chunks, with modest network traffic, to force the remote peer into allocating and holding structural wrappers that consume far more memory than the default documented message-size limit, leading to process termination due to OOM. This issue has been fixed in versions 5.2.5, 6.2.4, 7.5.11, and 8.21.0.

Publish Date: 2026-06-16

URL: CVE-2026-48779

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-16

Fix Resolution: https://github.com/websockets/ws.git - 7.5.11,https://github.com/websockets/ws.git - 8.21.0,https://github.com/websockets/ws.git - 6.2.4,https://github.com/websockets/ws.git - 5.2.5

CVE-2026-33151

Vulnerable Library - socket.io-parser-3.3.2.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.2.tgz

Sample Path to Dependency File: /app-to-app-js/package.json

Path to vulnerable library: /app-to-app-js/node_modules/socket.io-parser/package.json,/app-to-phone-js/node_modules/socket.io-parser/package.json,/phone-to-app-js/node_modules/socket.io-parser/package.json,/in-app-messaging-js/node_modules/socket.io-parser/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • ❌ socket.io-parser-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. Prior to versions 3.3.5, 3.4.4, and 4.2.6, a specially crafted Socket.IO packet can make the server wait for a large number of binary attachments and buffer them, which can be exploited to make the server run out of memory. This issue has been patched in versions 3.3.5, 3.4.4, and 4.2.6.

Publish Date: 2026-03-20

URL: CVE-2026-33151

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-677m-j7p3-52f9

Release Date: 2026-03-18

Fix Resolution: socket.io-parser - 3.4.4,socket.io-parser - 4.2.6,socket.io-parser - 3.3.5

CVE-2024-37890

Vulnerable Library - ws-7.4.6.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.6.tgz

Sample Path to Dependency File: /app-to-phone-js/package.json

Path to vulnerable library: /app-to-phone-js/node_modules/ws/package.json,/in-app-messaging-js/node_modules/ws/package.json,/phone-to-app-js/node_modules/ws/package.json,/app-to-app-js/node_modules/ws/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • engine.io-client-3.5.3.tgz
        • ❌ ws-7.4.6.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.

Publish Date: 2024-06-17

URL: CVE-2024-37890

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3h5v-q93c-6h6q

Release Date: 2024-06-17

Fix Resolution (ws): 7.5.10

Direct dependency fix Resolution (nexmo-client): 9.1.5

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-32695

Vulnerable Library - socket.io-parser-3.3.2.tgz

socket.io protocol parser

Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.2.tgz

Sample Path to Dependency File: /app-to-app-js/package.json

Path to vulnerable library: /app-to-app-js/node_modules/socket.io-parser/package.json,/app-to-phone-js/node_modules/socket.io-parser/package.json,/phone-to-app-js/node_modules/socket.io-parser/package.json,/in-app-messaging-js/node_modules/socket.io-parser/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • socket.io-client-2.5.0.tgz
      • ❌ socket.io-parser-3.3.2.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2023-05-27

URL: CVE-2023-32695

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cqmj-92xf-r6r9

Release Date: 2023-05-27

Fix Resolution: socket.io-parser - 3.4.3,4.2.3

CVE-2023-25166

Vulnerable Library - formula-3.0.0.tgz

Math and string formula parser.

Library home page: https://registry.npmjs.org/@⁠sideway/formula/-/formula-3.0.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/@⁠sideway/formula/package.json,/phone-to-app-js/node_modules/@⁠sideway/formula/package.json,/app-to-app-js/node_modules/@⁠sideway/formula/package.json,/app-to-phone-js/node_modules/@⁠sideway/formula/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • joi-17.6.3.tgz
        • ❌ formula-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

formula is a math and string formula parser. In versions prior to 3.0.1 crafted user-provided strings to formula's parser might lead to polynomial execution time and a denial of service. Users should upgrade to 3.0.1+. There are no known workarounds for this vulnerability.

Publish Date: 2023-02-08

URL: CVE-2023-25166

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2jc-4fpr-4vhg

Release Date: 2023-02-08

Fix Resolution: @⁠sideway/formula - 3.0.1

CVE-2026-48038

Vulnerable Libraries - joi-17.6.3.tgz, joi-17.4.0.tgz

joi-17.6.3.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.6.3.tgz

Sample Path to Dependency File: /phone-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.6.3.tgz (Vulnerable Library)

joi-17.4.0.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.

Publish Date: 2026-07-14

URL: CVE-2026-48038

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-06-12

Fix Resolution: https://github.com/hapijs/joi.git - 17.13.4

CVE-2026-90771

Vulnerable Libraries - joi-17.4.0.tgz, joi-17.6.3.tgz

joi-17.4.0.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.4.0.tgz (Vulnerable Library)

joi-17.6.3.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.6.3.tgz

Sample Path to Dependency File: /phone-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts proto as an error code. Attackers can supply proto keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-09-13

URL: CVE-2026-90771

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2026-09-13

Fix Resolution: joi - 17.13.8,joi - 18.2.9,https://github.com/hapijs/joi.git - v17.13.8,https://github.com/hapijs/joi.git - v18.2.9

CVE-2026-84368

Vulnerable Libraries - joi-17.4.0.tgz, joi-17.6.3.tgz

joi-17.4.0.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.4.0.tgz (Vulnerable Library)

joi-17.6.3.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.6.3.tgz

Sample Path to Dependency File: /phone-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.6 and 18.2.5, the @⁠hapi/joi package through 17.1.1 and the successor joi package contain prototype pollution in lib/messages.js, where exports.compile() and exports.merge() reuse inherited objects for attacker-controlled language keys supplied through messages(), message(), prefs({ messages }), Joi.extend({ messages }), or rule({ message }). A language key named proto writes properties onto Object.prototype, and constructor writes to the Object function's static properties. A consuming application that gates on the presence of an inherited property can take the wrong branch for every inspected object. The flaw is not reachable from data that joi validates and requires an application to feed untrusted input directly into schema-construction configuration. This issue is fixed in joi versions 17.13.6 and 18.2.5; no fixed @⁠hapi/joi version is available.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-09-01

URL: CVE-2026-84368

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6w3j-5fw6-r9vr

Release Date: 2026-09-01

Fix Resolution: joi - 18.2.5,joi - 17.13.6,https://github.com/hapijs/joi.git - v18.2.5,https://github.com/hapijs/joi.git - v17.13.6

CVE-2026-84367

Vulnerable Libraries - joi-17.4.0.tgz, joi-17.6.3.tgz

joi-17.4.0.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.4.0.tgz

Sample Path to Dependency File: /in-app-messaging-js/package.json

Path to vulnerable library: /in-app-messaging-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.4.0.tgz (Vulnerable Library)

joi-17.6.3.tgz

Object schema validation

Library home page: https://registry.npmjs.org/joi/-/joi-17.6.3.tgz

Sample Path to Dependency File: /phone-to-app-js/package.json

Path to vulnerable library: /phone-to-app-js/node_modules/joi/package.json,/app-to-phone-js/node_modules/joi/package.json,/app-to-app-js/node_modules/joi/package.json

Dependency Hierarchy:

  • nexmo-client-9.1.4.tgz (Root Library)
    • rtc-stats-adapter-1.2.0.tgz
      • ❌ joi-17.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 691e25809d42cce5a487504aa376638500c5b492

Found in base branch: main

Vulnerability Details

joi is a schema description language and data validator for JavaScript. From 16.0.0 until 17.13.5 and 18.2.4, joi's lib/types/keys.js internals.rename() implementation used by object().rename() permits a schema that renames keys with a regular-expression source and a Joi.expression() or Joi.x() target that interpolates the pattern's own match data, combined with { multiple: true }, to derive a target from an attacker-controlled input key. An attacker can send x-proto with an object value, causing the target to render as proto and set the prototype of the object returned by validate() instead of creating an own key. The global Object.prototype is not modified, so the effect is confined to the object returned by that validation call. Static-string targets and schemas using the default { multiple: false } are not affected. This issue is fixed in versions 17.13.5 and 18.2.4.
Mend Note: The description of this vulnerability differs from MITRE.

Publish Date: 2026-09-01

URL: CVE-2026-84367

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gg4h-3hg2-grpc

Release Date: 2026-09-01

Fix Resolution: joi - 17.13.5,joi - 18.2.4,https://github.com/hapijs/joi.git - v18.2.4,https://github.com/hapijs/joi.git - v17.13.5

⛑️Automatic Remediation will be attempted for this issue.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Mend: dependency security vulnerabilitySecurity vulnerability detected by Mend

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions