CVE-2026-41683
HighSummary
i18next-http-middleware prior to version 3.9.3 allows injection of user-controlled language values into the Content-Language response header, potentially leading to CRLF attacks. This issue has been patched in version 3.9.3.
Risk Assessment
Organizations may be exposed to attacks that exploit injected CRLF sequences, potentially leading to unauthorized access or data manipulation in HTTP responses.
Recommendation
It is recommended to upgrade i18next-http-middleware to version 3.9.3 or later to mitigate this vulnerability.
Other vulnerabilities in i18next-http-middleware
See all- CVE-2026-42353High
i18next-http-middleware prior to version 3.9.3 passed user-controlled lng and ns values without proper sanitization, potentially allowing for path traversal or SSRF attacks.
- CVE-2026-48714Critical
In versions prior to 3.9.7, the i18next-http-middleware did not block dotted variants of keys such as '__proto__.polluted', leading to the potential for remote prototype pollution in applications using i18next-fs-backend version ≤ 2.6.5.
- CVE-2026-48713Critical
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings, potentially allowing unauthorized writes to the global object prototype.
Original NVD description (English source)
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.