Описание
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
A flaw was found in joi, a JavaScript data validation library. When validating deeply nested input against recursive link() schemas, an uncaught RangeError is thrown due to excessive stack depth. If the application does not wrap validate() calls in a try/catch block, this unhandled exception crashes the process, resulting in a denial of service.
Отчет
A flaw was found in joi, a data validation library for JavaScript. Deeply nested input validated against recursive link() schemas triggers an uncaught RangeError that can crash the process when validate() is called without try/catch, leading to denial of service.
Меры по смягчению последствий
Upgrade to joi 17.13.4 or 18.2.1. As a workaround, wrap validate() calls in try/catch to prevent uncaught exceptions from crashing the process.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Cryostat 4 | joi | Not affected | ||
| Gatekeeper 3 | joi | Fix deferred | ||
| Migration Toolkit for Containers | joi | Fix deferred | ||
| Red Hat Build of Podman Desktop | joi | Fix deferred | ||
| Red Hat Data Grid 8 | joi | Not affected | ||
| Red Hat OpenShift AI (RHOAI) | joi | Fix deferred | ||
| Red Hat OpenShift Container Platform 4 | joi | Fix deferred | ||
| Red Hat OpenShift Dev Spaces | joi | Fix deferred |
Показывать по
Дополнительная информация
Статус:
EPSS
5.3 Medium
CVSS3
Связанные уязвимости
joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() schemas. When validate() is called without try/catch in a request handler, deeply nested input can trigger an unhandled RangeError and potentially crash the process; lower-impact paths using validateAsync() or try/catch produce a RangeError instead of a structured ValidationError. This issue is fixed in versions 17.13.4 and 18.2.1.
joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas
EPSS
5.3 Medium
CVSS3