Mitigating PHP2Shell: Everything You Need to Know
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-90771, is a prototype pollution issue in the joi library. The root cause lies in the lib/messages.js file, specifically within the compile and merge functions. These functions are responsible for processing and compiling custom error messages. Before the patch, neither function properly sanitized the keys of the message objects they were processing. An attacker could supply a message object with a key of __proto__. When the code iterates over the keys and assigns values, it would not create a new property on the object but would instead modify the prototype of all objects, leading to prototype pollution. The patch for this vulnerability introduces an assertion, assert(code !== '__proto__', 'Cannot use __proto__ as a message code');, at the points where the object properties are assigned in both compile and merge functions. This prevents the use of __proto__ as a key, thus mitigating the vulnerability. During exploitation, a call to Joi.any().messages() or Joi.any().prefs() with a malicious message object would trigger the vulnerable code path, and a runtime profiler would show the compile or merge functions in the stack trace.
compilelib/messages.js
mergelib/messages.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| joi | npm | < 17.13.8 | 17.13.8 |
| joi | npm | >= 18.0.0, < 18.2.9 | 18.2.9 |