i18next vulnerabilities

Newest CVEs

• CVE-2026-63402

  i18next: Shared built-in corruption through inherited-key deepExtend recursion

  i18next · i18next

  Medium5.9
• CVE-2026-118258

  i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

  i18next · i18next-http-backend

  Low3.7
• CVE-2026-115730

  i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

  i18next · i18next-http-backend

  Low2.3
• CVE-2026-105800

  i18next-http-backend incomplete URL validation permits SSRF

  i18next · i18next-http-backend

  Low3.7
• CVE-2026-48714

  i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

  i18next · i18next-http-middleware

  Critical9.1
• CVE-2026-48713

  i18next-fs-backend: Prototype pollution via crafted missing-key string

  i18next · i18next-fs-backend

  Critical9.1
• CVE-2026-41693

  i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite

  i18next · i18next-fs-backend

  High8.2
• CVE-2026-42353

  Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters

  i18next · i18next-http-middleware

  High8.2
• CVE-2026-41683

  HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header

  i18next · i18next-http-middleware

  High8.6
• CVE-2026-41690

  Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters

  i18next · i18next-http-middleware

  High8.6