Is CVE-2026-90771 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-90771?

CVE-2026-90771 has a CVSS v3 severity of LOW (3.7).

Back

CVE-2026-90771

Description

joi before versions 17.13.8 and 18.2.9 contains a prototype pollution vulnerability in the messages compilation function that accepts __proto__ as an error code. Attackers can supply __proto__ keys in custom messages to replace the returned object's prototype, breaking downstream code relying on Object.prototype methods.