{
  "@id": "urn:uuid:47556826-2c56-4e45-a5ae-b00868e2be4c",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 10,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:44:00.044793+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-04T01:20:58.791267+00:00",
      "status_notes": "Vulnerability CVE-2026-118772 does not affect version 6.10.1 of joi. not_affected \u2014 Version 6.10.1 is not affected by CVE-2026-118772. The vulnerability requires the `multiple: true` option for email validation, which triggers regex splitting with catastrophic backtracking on long whitespace runs. This feature was introduced in commit 9c84975e on 2019-06-03, nearly 4 years after version 6.10.1 was released (2015-11-26). The email validation in version 6.10.1 (lib/string.js:182...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118772"
      },
      "impact_statement": "not_affected \u2014 Version 6.10.1 is not affected by CVE-2026-118772. The vulnerability requires the `multiple: true` option for email validation, which triggers regex splitting with catastrophic backtracking on long whitespace runs. This feature was introduced in commit 9c84975e on 2019-06-03, nearly 4 years after version 6.10.1 was released (2015-11-26). The email validation in version 6.10.1 (lib/string.js:182..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-06T06:55:00.133341+00:00",
      "status_notes": "Vulnerability CVE-2026-122131 does not affect version 6.10.1 of joi. not_affected \u2014 The target is joi 6.10.1, an ancient release of the same project. It has no lib/messages.js and no compile()/merge() compiled-messages store. The CVE's vulnerable code (introduced in 17.13.6 and 18.2.5) does not exist here, so the prototype-replacement chain cannot occur.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-122131"
      },
      "impact_statement": "not_affected \u2014 The target is joi 6.10.1, an ancient release of the same project. It has no lib/messages.js and no compile()/merge() compiled-messages store. The CVE's vulnerable code (introduced in 17.13.6 and 18.2.5) does not exist here, so the prototype-replacement chain cannot occur."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-09-24T15:52:27.770861+00:00",
      "status_notes": "Vulnerability CVE-2026-48038 does not affect version 6.10.1 of joi. not_affected \u2014 Target version 6.10.1 is not affected by CVE-2026-48038. The vulnerability requires the Joi.link() feature for recursive schema validation, which was introduced in version 16.0.0 (released 2019-07-12). Version 6.10.1 predates this feature by approximately 10 major versions and has no mechanism to create recursive link schemas.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-48038"
      },
      "impact_statement": "not_affected \u2014 Target version 6.10.1 is not affected by CVE-2026-48038. The vulnerability requires the Joi.link() feature for recursive schema validation, which was introduced in version 16.0.0 (released 2019-07-12). Version 6.10.1 predates this feature by approximately 10 major versions and has no mechanism to create recursive link schemas."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:07:09.489340+00:00",
      "status_notes": "Vulnerability CVE-2026-84367 does not affect version 6.10.1 of joi. not_affected \u2014 joi 6.10.1 has no regex-sourced or template (Joi.x / expression) rename targets. rename() only accepts static string from/to, so an attacker's input key cannot influence the rename target name and cannot make it render as __proto__.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-84367"
      },
      "impact_statement": "not_affected \u2014 joi 6.10.1 has no regex-sourced or template (Joi.x / expression) rename targets. rename() only accepts static string from/to, so an attacker's input key cannot influence the rename target name and cannot make it render as __proto__."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:31.871982+00:00",
      "status_notes": "Vulnerability CVE-2026-84368 does not affect version 6.10.1 of joi. not_affected \u2014 Target is joi 6.10.1. The vulnerable code described by CVE-2026-84368 does not exist in it: there is no messages()/message()/prefs({messages})/Joi.extend/rule({message}) and no language-name registry that reuses the object found at a user-supplied key. Joi 6 resolves error text with Hoek.reach over a plain language option. A residual prototype-pollution risk exists in the declared dependency ho...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-84368"
      },
      "impact_statement": "not_affected \u2014 Target is joi 6.10.1. The vulnerable code described by CVE-2026-84368 does not exist in it: there is no messages()/message()/prefs({messages})/Joi.extend/rule({message}) and no language-name registry that reuses the object found at a user-supplied key. Joi 6 resolves error text with Hoek.reach over a plain language option. A residual prototype-pollution risk exists in the declared dependency ho..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-10-06T09:18:00.239158+00:00",
      "status_notes": "Vulnerability CVE-2026-90771 does not affect version 6.10.1 of joi. not_affected \u2014 Version 6.10.1 is not affected by CVE-2026-90771. The vulnerability exists in the messages compilation function (lib/messages.js) and the .messages() API, which were introduced in version 16.0.0. Version 6.10.1 uses a completely different architecture for custom error messages, relying on static language definitions in lib/language.js and options merging via lib/any.js, without the dynamic mess...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-90771"
      },
      "impact_statement": "not_affected \u2014 Version 6.10.1 is not affected by CVE-2026-90771. The vulnerability exists in the messages compilation function (lib/messages.js) and the .messages() API, which were introduced in version 16.0.0. Version 6.10.1 uses a completely different architecture for custom error messages, relying on static language definitions in lib/language.js and options merging via lib/any.js, without the dynamic mess..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-14T02:44:00.044793+00:00",
      "status_notes": "Vulnerability CVE-2026-92599 does not affect version 6.10.1 of joi. not_affected \u2014 joi 6.10.1 is not affected. The isoDate check is one regex (lib/date.js:14) anchored with ^ and $. It does not have the unanchored sub-pattern behind the quadratic restart. Timing with the CVE's input shape (valid date, then up to 256 KB of fractional digits) stayed at 0-2 ms.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-92599"
      },
      "impact_statement": "not_affected \u2014 joi 6.10.1 is not affected. The isoDate check is one regex (lib/date.js:14) anchored with ^ and $. It does not have the unanchored sub-pattern behind the quadratic restart. Timing with the CVE's input shape (valid date, then up to 256 KB of fractional digits) stayed at 0-2 ms."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/joi@6.10.1",
          "identifiers": {
            "purl": "pkg:npm/joi@6.10.1"
          }
        }
      ],
      "timestamp": "2026-11-04T15:06:15.083779+00:00",
      "status_notes": "Vulnerability GHSA-mrx9-2rrp-rhpx is a false positive for joi 6.10.1.",
      "vulnerability": {
        "name": "GHSA-mrx9-2rrp-rhpx"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}