{
  "@id": "urn:uuid:a7ec5231-c74e-499a-a402-fd3b6a25720c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 11,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T15:43:00.148703+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:13:00.060830+00:00",
      "status_notes": "Vulnerability CVE-2026-118772 does not affect version 11.4.0 of joi. not_affected \u2014 Target is joi 11.4.0, the same product lineage as the CVE. Its string().email() rule has no `multiple` or `separator` option and contains no whitespace-trimming separator-split regex. It passes the whole value to the isemail dependency. The vulnerable split code from joi 17.1.1+ / 18.x is absent, so the CVE does not apply.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118772"
      },
      "impact_statement": "not_affected \u2014 Target is joi 11.4.0, the same product lineage as the CVE. Its string().email() rule has no `multiple` or `separator` option and contains no whitespace-trimming separator-split regex. It passes the whole value to the isemail dependency. The vulnerable split code from joi 17.1.1+ / 18.x is absent, so the CVE does not apply."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T03:16:00.082768+00:00",
      "status_notes": "Vulnerability CVE-2026-122131 does not affect version 11.4.0 of joi. not_affected \u2014 Target is joi 11.4.0, an old lineage of the same product. It has no lib/messages.js and no compile()/merge() that builds a compiled message store from user-supplied language keys. The CVE affects only 17.13.6\u201317.13.9 and 18.2.5\u201318.3.1. In 11.4.0, language maps are plain objects read via Hoek.reach and merged via Hoek.applyToDefaults, and top-level options are strictly validated. I found no path...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-122131"
      },
      "impact_statement": "not_affected \u2014 Target is joi 11.4.0, an old lineage of the same product. It has no lib/messages.js and no compile()/merge() that builds a compiled message store from user-supplied language keys. The CVE affects only 17.13.6\u201317.13.9 and 18.2.5\u201318.3.1. In 11.4.0, language maps are plain objects read via Hoek.reach and merged via Hoek.applyToDefaults, and top-level options are strictly validated. I found no path..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:44:30.077058+00:00",
      "status_notes": "Vulnerability CVE-2026-48038 affects version 11.4.0 of joi.",
      "vulnerability": {
        "name": "CVE-2026-48038"
      },
      "action_statement": "Vulnerability CVE-2026-48038 affects version 11.4.0 of joi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:07:09.489340+00:00",
      "status_notes": "Vulnerability CVE-2026-84367 does not affect version 11.4.0 of joi. not_affected \u2014 The target is joi 11.4.0 (hapi/joi lineage). The CVE requires a rename target rendered from the regex match via Joi.expression()/Joi.x(). That feature does not exist in 11.4.0: rename() asserts that `to` is a string, so the rename target is always static and cannot be derived from attacker-controlled input keys. The attacker-controlled key can therefore never become the assignment key `__proto__`.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-84367"
      },
      "impact_statement": "not_affected \u2014 The target is joi 11.4.0 (hapi/joi lineage). The CVE requires a rename target rendered from the regex match via Joi.expression()/Joi.x(). That feature does not exist in 11.4.0: rename() asserts that `to` is a string, so the rename target is always static and cannot be derived from attacker-controlled input keys. The attacker-controlled key can therefore never become the assignment key `__proto__`."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:43.079282+00:00",
      "status_notes": "Vulnerability CVE-2026-84368 does not affect version 11.4.0 of joi. not_affected \u2014 joi 11.4.0 predates the messages()/message()/prefs({messages})/rule({message}) API and the messages module the CVE patch changes. No joi code looks up a language bucket by attacker key and reuses the inherited object it finds. The nearest equivalents, any.options({language}) and Joi.extend({language}), do not reach the Goal in joi's own code. The only deep merge is delegated to the external hoe...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-84368"
      },
      "impact_statement": "not_affected \u2014 joi 11.4.0 predates the messages()/message()/prefs({messages})/rule({message}) API and the messages module the CVE patch changes. No joi code looks up a language bucket by attacker key and reuses the inherited object it finds. The nearest equivalents, any.options({language}) and Joi.extend({language}), do not reach the Goal in joi's own code. The only deep merge is delegated to the external hoe..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T15:43:00.148703+00:00",
      "status_notes": "Vulnerability CVE-2026-90771 affects version 11.4.0 of joi, and is fixed in 11.4.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-90771"
      },
      "action_statement": "Vulnerability CVE-2026-90771 affects version 11.4.0 of joi, and is fixed in 11.4.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-14T02:48:45.028933+00:00",
      "status_notes": "Vulnerability CVE-2026-92599 does not affect version 11.4.0 of joi. not_affected \u2014 joi 11.4.0 is not affected. The only regex on the string.isoDate() path (internals.isoDate in lib/types/date/index.js:14) is anchored with ^...$. The unanchored regex described in the CVE does not exist in this old codebase. Timing the regex directly with digit tails up to 256 KB and failing suffixes (x, ':', '!') took only a few ms, with no quadratic growth. I could not read the patch diffs, w...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-92599"
      },
      "impact_statement": "not_affected \u2014 joi 11.4.0 is not affected. The only regex on the string.isoDate() path (internals.isoDate in lib/types/date/index.js:14) is anchored with ^...$. The unanchored regex described in the CVE does not exist in this old codebase. Timing the regex directly with digit tails up to 256 KB and failing suffixes (x, ':', '!') took only a few ms, with no quadratic growth. I could not read the patch diffs, w..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@11.4.0",
          "identifiers": {
            "purl": "pkg:npm/joi@11.4.0"
          }
        }
      ],
      "timestamp": "2026-11-04T15:06:15.083779+00:00",
      "status_notes": "Vulnerability GHSA-mrx9-2rrp-rhpx is a false positive for joi 11.4.0.",
      "vulnerability": {
        "name": "GHSA-mrx9-2rrp-rhpx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}