CVE-2026-118772: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Severity: high. ### Summary `Joi.string().email({ multiple: true })` takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. ### Details When the `multiple` option is set,

Читать первоисточник →