Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string().email({ multiple: true }) rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no separator, causing quadratic work during String.prototype.split. The behavior applies to the default separator and every custom separator. Applications that validate attacker-controlled values with the multiple option and no effective prior length limit can have the Node.js event loop blocked for seconds by one request, preventing other work. A .max() rule is not sufficient when abortEarly: false allows the email rule to run after the maximum-length check fails. This vulnerability is fixed in versions 17.13.9 and 18.3.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
🔴 Joi, Quadratic-Time Split Vulnerability in string()email({ multiple: true }), #CVE-2026-118772 (High) -DC-Oct2026-4030 https://dailycve.com/joi-quadratic-time-split-vulnerability-in-stringemail-multiple-true-cve-2026-118772-high-dc-oct2026-4030/
NewNormal Security turns CVEs since the previous batch into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 30 Oct 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 🖥️ Exposed development server — serves the project's own source and every private runtime config value, API keys included (Nuxt CVE-2026-119199, Nuxt CVE-2026-119201) 🚨 VPN appliance denial of service, exploited in the wild — one crafted connection drops the remote-access VPN, unauthenticated (Cisco CVE-2026-76418) 📦 Regular-expression denial of service in input validation — one oversized field pins the Node event loop (Joi CVE-2026-118772) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #SecretsExposure #CSO #REDTEAM