i18next-http-middleware vulnerabilities

i18next-http-middleware prior to version 3.9.3 passed user-controlled lng and ns values without proper sanitization, potentially allowing for path traversal or SSRF attacks.

i18next-http-middleware prior to version 3.9.3 allows injection of user-controlled language values into the Content-Language response header, potentially leading to CRLF attacks. This issue has been patched in version 3.9.3.

In versions prior to 3.9.7, the i18next-http-middleware did not block dotted variants of keys such as '__proto__.polluted', leading to the potential for remote prototype pollution in applications using i18next-fs-backend version ≤ 2.6.5.

Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings, potentially allowing unauthorized writes to the global object prototype.