CVE-2026-118258
LowCVSS 3.7Summary
i18next-http-backend prior to 4.0.4 has interpolateUrl inserting unencoded language and namespace values into loadPath or addPath templates without rejecting &, =, or ; query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on translation requests, potentially exposing other namespaces or tenants. This is an incomplete fix for CVE-2026-41691, fixed in 4.0.4.
Risk Assessment
An attacker can manipulate translation requests on the browser or server side, exposing data from other namespaces or tenants. This may breach confidentiality and alter backend behavior depending on the application's network position and credentials.
Recommendation
Update i18next-http-backend to version 4.0.4 or later. Ensure lng and ns values are not inserted into the query string without encoding.
Other vulnerabilities in i18next-http-backend
See all- CVE-2026-115730Low
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
- CVE-2026-105800Low
i18next-http-backend prior to 4.0.2 allows attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} to make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery.
Original NVD description (English source)
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS