CVE-2026-105800
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} to make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery.
Risk Assessment
URL injection or server-side request forgery may allow access to internal resources or execution of unauthorized requests. This can compromise the security of the application and infrastructure.
Recommendation
Upgrade i18next-http-backend to version 4.0.2 or later. Avoid using loadPath or addPath templates that begin directly with {{lng}} or {{ns}}.
Other vulnerabilities in i18next-http-backend
See all- CVE-2026-118258Low
i18next-http-backend prior to 4.0.4 has interpolateUrl inserting unencoded language and namespace values into loadPath or addPath templates without rejecting &, =, or ; query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on translation requests, potentially exposing other namespaces or tenants. This is an incomplete fix for CVE-2026-41691, fixed in 4.0.4.
- CVE-2026-115730Low
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Original NVD description (English source)
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS