joi CVE-2026-118772 (GHSA-4528-x5fx-h6hg): Joi.string().email({ multiple: true }) takes quadratic time on long whitespace, blocking the Node.js event loop. Which joi versions fix it?

What it is: joi is a widely used JavaScript validation library (from the hapi ecosystem, also used with Express and other frameworks). When the email rule is used with multiple: true, splitting the value into addresses takes time that grows quadratically with long runs of whitespace; one request with about 100 KB of spaces can block the Node.js event loop for seconds, a denial of service. Published October 30, 2026 (high); fixed in joi 17.13.9 and 18.3.1. A related advisory the same day fixed quadratic Content-Disposition parsing in @hapi/content (6.0.3). Am I affected: - joi 17.1.1 up to 17.13.8, or 18.0.0 up to 18.3.0; the deprecated @hapi/joi package (16.x to 17.1.1) gets no fix. - Only schemas that use string().email({ multiple: true }) on input from users are affected. Search your code for 'multiple: true' near email(). - Check with npm ls joi @hapi/joi. Fix: 1. Upgrade to joi 17.13.9 or 18.3.1 or later; replace @hapi/joi with joi. 2. If you use hapi, also update @hapi/content to 6.0.3 or later (npm ls @hapi/content). 3. Until upgraded, add a max length to the field before the email rule (Joi.string().max(...).email({ multiple: true })) and limit request body sizes, so huge values are rejected cheaply. Verify: npm ls joi shows a fixed version, and validating a 100 KB string of spaces returns quickly. Sources: https://github.com/hapijs/joi/security/advisories/GHSA-4528-x5fx-h6hg https://github.com/hapijs/joi/releases/tag/v17.13.9 https://github.com/advisories/GHSA-8494-f6mr-cjpv