Is @hapi/joi safe to use?

@hapi/joi has 1 known vulnerabilities on the latest version (17.1.1). DepScope rates its health at 52/100 (high risk).

What is the latest version of @hapi/joi?

The latest version of @hapi/joi is 17.1.1, released 2020-03-14.

Does @hapi/joi have known vulnerabilities?

Yes. @hapi/joi has 1 known vulnerabilities. See depscope.dev/pkg/npm/@hapi/joi for details.

Is @hapi/joi deprecated?

Yes, @hapi/joi is deprecated: Switch to 'npm install joi' Consider using ? instead.

What are alternatives to @hapi/joi?

Popular alternatives to @hapi/joi in npm include: ?, semver, debug, minimatch, ansi-styles.

What license does @hapi/joi use?

@hapi/joi is licensed under BSD-3-Clause.

@hapi/joi

npmv17.1.1deprecated

Object schema validation

License BSD-3-Clausepermissive28 versions6 maintainers5 deps1,222,215 weekly dl

hapijs/joi

/ 100

Health

find alternative

@hapi/joi is deprecated — find an alternative

Update to >= 18.2.5 to fix known vulnerabilities

Moderate health score (52/100) — verify manually
Package is deprecated

Health breakdown0 – 100

15/25

maintenance

17/20

popularity

25/25

security

12/15

maturity

13/15

community

Vulnerabilities

1 low

Advisories (1)

Severity	ID	Summary	Fixed in
low	CVE-2026-84368	joi: Prototype pollution via a `__proto__` language key in custom messages	18.2.5

Bundle & TypeScript

🌟

TypeScript

7/10typed

Types from @types/hapi__joi (DefinitelyTyped)

Quality signals

OSS Criticality

0.79critical

Publish security

npm signed

Health History

Dependency Tree

License Audit

Dependencies (5)

@hapi/hoek @hapi/topo @hapi/address @hapi/formula @hapi/pinpoint

API access

Get this data programmatically — free, no authentication.

curl https://depscope.dev/api/check/npm/@hapi/joi