# What changed in joi

> 5 changes in joi 18 from its official release notes, upgrade guides and advisories: 5 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/joi/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## joi 18

### Security

- joi messages compilation allows prototype replacement through __proto__ error codes (17.13.8, 18.2.9) — [security advisory](https://github.com/advisories/GHSA-WR44-6HXH-3JWQ)
- joi: Quadratic regular-expression backtracking in `Joi.string().isoDate()` (17.13.7, 18.2.6) — [security advisory](https://github.com/advisories/GHSA-6H2X-M376-MQJQ)
- joi: Prototype pollution via a `__proto__` language key in custom messages (17.13.6, 18.2.5) — [security advisory](https://github.com/advisories/GHSA-6W3J-5FW6-R9VR)
- joi: object().rename() with a template target can set the validated object's prototype (17.13.5, 18.2.4) — [security advisory](https://github.com/advisories/GHSA-GG4H-3HG2-GRPC)
- joi has an uncaught RangeError on deeply nested input through recursive `link()` schemas (17.13.4, 18.2.1) — [security advisory](https://github.com/advisories/GHSA-Q7CG-457F-VX79)