CVE-2026-42353
HighSummary
i18next-http-middleware prior to version 3.9.3 passed user-controlled lng and ns values without proper sanitization, potentially allowing for path traversal or SSRF attacks.
Risk Assessment
Organizations may be exposed to unauthorized access to systems or data, leading to serious security breaches.
Recommendation
It is recommended to upgrade i18next-http-middleware to version 3.9.3 or later to mitigate this vulnerability.
Other vulnerabilities in i18next-http-middleware
See all- CVE-2026-41683High
i18next-http-middleware prior to version 3.9.3 allows injection of user-controlled language values into the Content-Language response header, potentially leading to CRLF attacks. This issue has been patched in version 3.9.3.
- CVE-2026-48714Critical
In versions prior to 3.9.7, the i18next-http-middleware did not block dotted variants of keys such as '__proto__.polluted', leading to the potential for remote prototype pollution in applications using i18next-fs-backend version ≤ 2.6.5.
- CVE-2026-48713Critical
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings, potentially allowing unauthorized writes to the global object prototype.
Original NVD description (English source)
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.