CVE-2026-92599: Joi npm Package ReDoS DOS Vulnerability

CVE-2026-92599 Overview

CVE-2026-92599 is a regular expression denial of service (ReDoS) vulnerability in the joi npm package, a widely used schema validation library maintained by the hapi.js project. The flaw resides in the Joi.string().isoDate() validation rule. An unanchored regular expression allows a valid ISO date followed by a long run of fractional-second digits to trigger catastrophic backtracking. Processing time grows quadratically with input length, reaching roughly 1.4 seconds for 64 KB and about 22 seconds for 256 KB of digits. A remote attacker who can submit a string to an isoDate() validator can stall the application with a single request.

Critical Impact
A single unauthenticated HTTP request containing a crafted ISO date string can freeze a Node.js event loop, denying service to every concurrent client of the affected process.

Affected Products

joi npm package versions >=17.2.0 <17.13.7
joi npm package versions >=18.0.0 <18.2.6
Any hapi.js or Node.js application invoking Joi.string().isoDate() on untrusted input

Discovery Timeline

2026-09-16 - CVE-2026-92599 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92599

Vulnerability Analysis

The defect is categorized as inefficient regular expression complexity [CWE-1333]. The isoDate() validator compiles a pattern that accepts an ISO 8601 timestamp with optional fractional seconds. Because the pattern is not anchored, the regex engine retries the match starting at every offset in the input when the tail of the string fails to match the terminating structure. Combined with the greedy quantifier over fractional-second digits, this produces backtracking behavior that scales with the square of input length.

An attacker who supplies a string like 2024-01-01T00:00:00. followed by tens of thousands of digits forces the Node.js single-threaded event loop to block for seconds or minutes. Every other request handled by the same worker stalls. In multi-tenant API deployments the attack scales linearly: a handful of concurrent requests can exhaust every worker in a cluster.

Root Cause

The root cause is an unanchored regular expression applied to unbounded input. The pattern lacks ^ and $ anchors, so the JavaScript regex engine reattempts the match at successive positions when the fractional-second segment ultimately fails to satisfy the timezone portion of the pattern. Each retry reprocesses the long digit run, producing O(n²) worst-case behavior on adversarial input.

Attack Vector

Exploitation requires only network access to any endpoint that validates a user-controlled string with Joi.string().isoDate(). No authentication, privileges, or user interaction are needed. Typical targets include REST API request bodies, query parameters, WebSocket messages, and form fields where date validation is applied at the schema layer. The attacker sends a payload of the form <valid-iso-date>.<long-run-of-digits> and the request handler blocks the event loop while the regex engine backtracks. See the GitHub Security Advisory GHSA-6h2x-m376-mqjq and the VulnCheck Advisory on Joi for the pattern details and proof-of-concept measurements.

Detection Methods for CVE-2026-92599

Indicators of Compromise

Request bodies or query parameters containing an ISO 8601 date prefix followed by hundreds or thousands of consecutive digits after a . separator.
Node.js worker processes exhibiting sustained 100% CPU on a single core with an unresponsive event loop.
Application logs showing request handler durations spiking from milliseconds to multiple seconds without corresponding downstream calls.

Detection Strategies

Inventory dependencies for vulnerable joi ranges using npm ls joi or a software composition analysis (SCA) scan against lockfiles.
Add web application firewall (WAF) or reverse proxy rules that flag string fields exceeding a reasonable maximum length, especially those matching a date-like prefix.
Enable Node.js event loop lag metrics (for example via perf_hooks.monitorEventLoopDelay) and alert on sustained lag above a service-specific threshold.

Monitoring Recommendations

Track p95 and p99 latency per route and alert on sudden shifts on endpoints that accept date inputs.
Correlate high CPU usage on Node.js workers with request payload sizes to surface algorithmic complexity attacks.
Ingest reverse proxy access logs into a centralized analytics platform to hunt for repeated large payloads targeting the same validator.

How to Mitigate CVE-2026-92599

Immediate Actions Required

Upgrade joi to 17.13.7 on the 17.x branch or 18.2.6 on the 18.x branch.
Where an immediate upgrade is not possible, enforce a maximum length on any string reaching Joi.string().isoDate(), either at the framework layer or by prepending .max() in the schema.
Deploy request-size limits at the reverse proxy or API gateway to reject oversized inputs before they reach Node.js.

Patch Information

The joi maintainers released fixes in joi@17.13.7 and joi@18.2.6. The patched versions anchor the regular expression used by isoDate() so that trailing content cannot trigger repeated backtracking. Consult the GitHub Security Advisory GHSA-6h2x-m376-mqjq for the fix commit and version metadata.

Workarounds

Add .max(64) or a similarly tight bound before .isoDate() on every schema that validates date strings from untrusted sources.
Wrap validation calls in a timeout using AbortController or a worker thread so that a stalled regex cannot block the main event loop indefinitely.
Reject requests whose Content-Length exceeds application needs at the ingress layer.

bash

# Upgrade to patched joi versions
npm install joi@^17.13.7   # for 17.x consumers
npm install joi@^18.2.6    # for 18.x consumers

# Verify the resolved version in the dependency tree
npm ls joi