{
  "@id": "urn:uuid:0c5d20be-1362-4ac5-a679-b5d3b78a65e0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 8,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T03:19:00.062203+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-10-30T23:16:27.956660+00:00",
      "status_notes": "Vulnerability CVE-2026-118772 affects version 18.2.9 of joi.",
      "vulnerability": {
        "name": "CVE-2026-118772"
      },
      "action_statement": "Vulnerability CVE-2026-118772 affects version 18.2.9 of joi."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-04T20:39:00.042959+00:00",
      "status_notes": "Vulnerability CVE-2026-122131 affects version 18.2.9 of joi.",
      "vulnerability": {
        "name": "CVE-2026-122131"
      },
      "action_statement": "Vulnerability CVE-2026-122131 affects version 18.2.9 of joi."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-14T03:18:00.034383+00:00",
      "status_notes": "Vulnerability CVE-2026-48038 does not affect version 18.2.9 of joi. not_affected \u2014 Target is joi 18.2.9, which already includes the upstream fix for CVE-2026-48038 (fc146a62 'fix: protect link recursion from max call stack', merged by 2392713d). lib/types/link.js wraps the recursive linked validation in try/catch and converts a RangeError into a structured 'link.depth' validation error. The fix shipped in the upstream release (author nicolas@morel.io), before the TuxCare auto...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48038"
      },
      "impact_statement": "not_affected \u2014 Target is joi 18.2.9, which already includes the upstream fix for CVE-2026-48038 (fc146a62 'fix: protect link recursion from max call stack', merged by 2392713d). lib/types/link.js wraps the recursive linked validation in try/catch and converts a RangeError into a structured 'link.depth' validation error. The fix shipped in the upstream release (author nicolas@morel.io), before the TuxCare auto..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-14T02:07:47.951572+00:00",
      "status_notes": "Vulnerability CVE-2026-84367 does not affect version 18.2.9 of joi. not_affected \u2014 Joi 18.2.9 already contains the upstream fix (162f367a, \"fix: prevent proto on renames\", merged via 262c4f10). internals.rename in lib/types/keys.js rejects a rendered rename target of '__proto__' with 'object.rename.proto' and skips the assignment. The CVE's fix is in 17.13.5 and 18.2.4, so 18.2.9 is past it. The fix shipped in the upstream release, before the first TuxCare commit.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84367"
      },
      "impact_statement": "not_affected \u2014 Joi 18.2.9 already contains the upstream fix (162f367a, \"fix: prevent proto on renames\", merged via 262c4f10). internals.rename in lib/types/keys.js rejects a rendered rename target of '__proto__' with 'object.rename.proto' and skips the assignment. The CVE's fix is in 17.13.5 and 18.2.4, so 18.2.9 is past it. The fix shipped in the upstream release, before the first TuxCare commit."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:19.935102+00:00",
      "status_notes": "Vulnerability CVE-2026-84368 does not affect version 18.2.9 of joi. not_affected \u2014 joi 18.2.9 already contains the upstream fix (released in 18.2.5) for CVE-2026-84368. In lib/messages.js, compile() and merge() reuse a language entry only if Object.hasOwn(target, language) is true, so '__proto__' and 'constructor' no longer resolve to inherited objects. Both functions also assert against '__proto__' as a flat code or nested key. The fix commit 90d07571 was authored upstream b...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84368"
      },
      "impact_statement": "not_affected \u2014 joi 18.2.9 already contains the upstream fix (released in 18.2.5) for CVE-2026-84368. In lib/messages.js, compile() and merge() reuse a language entry only if Object.hasOwn(target, language) is true, so '__proto__' and 'constructor' no longer resolve to inherited objects. Both functions also assert against '__proto__' as a flat code or nested key. The fix commit 90d07571 was authored upstream b..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-14T03:19:00.062203+00:00",
      "status_notes": "Vulnerability CVE-2026-90771 does not affect version 18.2.9 of joi. not_affected \u2014 joi 18.2.9 already contains the upstream fix for CVE-2026-90771. lib/messages.js now rejects `__proto__` as a message code in compile() and merge(), and no longer reuses an inherited object for language keys. The fix came from the upstream release (commits 5b8333c9 and 7363128f), not from a TuxCare backport.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-90771"
      },
      "impact_statement": "not_affected \u2014 joi 18.2.9 already contains the upstream fix for CVE-2026-90771. lib/messages.js now rejects `__proto__` as a message code in compile() and merge(), and no longer reuses an inherited object for language keys. The fix came from the upstream release (commits 5b8333c9 and 7363128f), not from a TuxCare backport."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-14T02:43:38.867791+00:00",
      "status_notes": "Vulnerability CVE-2026-92599 does not affect version 18.2.9 of joi. not_affected \u2014 Joi 18.2.9 already contains the upstream fix (commit e70df424, in the 18.2.x line, which dropped the unanchored leading `.*` from the isoDate timeshift regex). The fix shipped in the upstream release before any TuxCare commit. The regexes run by string().isoDate() are linear-time on a long fractional-digit run (262144 digits: about 0-1 ms).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-92599"
      },
      "impact_statement": "not_affected \u2014 Joi 18.2.9 already contains the upstream fix (commit e70df424, in the 18.2.x line, which dropped the unanchored leading `.*` from the isoDate timeshift regex). The fix shipped in the upstream release before any TuxCare commit. The regexes run by string().isoDate() are linear-time on a long fractional-digit run (262144 digits: about 0-1 ms)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@18.2.9",
          "identifiers": {
            "purl": "pkg:npm/joi@18.2.9"
          }
        }
      ],
      "timestamp": "2026-11-04T15:06:15.083779+00:00",
      "status_notes": "Vulnerability GHSA-mrx9-2rrp-rhpx is a false positive for joi 18.2.9.",
      "vulnerability": {
        "name": "GHSA-mrx9-2rrp-rhpx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}