joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service

Summary Joi.string().email({ multiple: true }) takes quadratic time to split a value that contains a long run of whitespace. One request with 100 KB of spaces blocks the Node.js event loop for several seconds, which causes a denial of service. Details When the multiple option is set, the email rule splits the value into addresses with a regular expression that removes whitespace on each side of the separator: js const regex = new RegExp(\\s[${options.separator ? escapeRegex(options.separator) : ','}]\\s); // ... const emails = options.multiple ? value.split(regex) : [value]; String.prototype.split tries a match at each position of the value. At each position inside a whitespace run, the leading \s reads the rest of the run, does not find a separator, and backtracks through all of it. A run of n whitespace characters without a separator therefore costs n² steps. This applies to the default separator and to all custom separator values. The fix lets the leading whitespace match start only at the beginning of a whitespace run, so the split is linear: js const regex = new RegExp((?:(? "} Impact This is a denial of service by CPU exhaustion. It affects each application that validates…

curl https://cve.zerocrew.in/api/cve/CVE-2026-118772