Joi Denial-of-Service Vulnerability via Unhandled RangeError in Recursive Link Validation

A denial-of-service vulnerability has been identified in Joi, a popular JavaScript schema description and data validation library. This issue affects versions of Joi prior to 17.13.4 and 18.2.1. The vulnerability arises when services validate user-supplied JSON or object input using recursive link schemas. If the validate() function is called without a try/catch block in a request handler, deeply nested input can cause an unhandled RangeError, potentially crashing the process. Although lower-impact validation paths using validateAsync() or a try/catch block are available, they still result in a RangeError instead of a properly structured ValidationError, complicating error handling.

Impact

Exploitation of this vulnerability can lead to a process crash due to an unhandled RangeError, especially when validate() is used without try/catch in a request handler. This vulnerability can also disrupt applications by causing validation errors that are not properly structured, making error handling more difficult.

Reproduction

To reproduce this vulnerability, create a Joi schema that includes recursive links. Then, use the validate() method without a try/catch block to process deeply nested input. This will trigger an unhandled RangeError, causing the application to crash. Alternatively, validateAsync() or validate() with try/catch can be used, but these methods will only produce a RangeError without the structured validation error, complicating error management.

Remediation

Upgrade to Joi version 17.13.4 or 18.2.1 or later. If immediate upgrading is not possible, wrap validation calls in a try/catch block to manage exceptions and prevent crashes.