Impact
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
- Highest impact:
validate() called without try/catch in a request handler would cause an unhandled exception, potentially crashing the process.
- Lower impact:
validateAsync() or validate() inside a try/catch, the validation fails, but the error type is RangeError rather than a structured ValidationError, complicating error handling.
Patches
Upgrade to version >= 18.2.1 or >= 17.13.4.
Workarounds
Try/catch the validation to avoid uncaught exceptions.
References
Impact
Denial of service via untrapped exception in services validating user-supplied JSON / object input with recursive link schemas.
The blast radius depends on how the application invokes joi:
validate()called withouttry/catchin a request handler would cause an unhandled exception, potentially crashing the process.validateAsync()orvalidate()inside atry/catch, the validation fails, but the error type isRangeErrorrather than a structuredValidationError, complicating error handling.Patches
Upgrade to version >= 18.2.1 or >= 17.13.4.
Workarounds
Try/catch the validation to avoid uncaught exceptions.
References