I18next vulnerabilities

Products

• I18next-http-backend 4
• I18next-http-middleware 4
• I18next 3
• I18next-fs-backend 2

Newest

• i18next i18next: Shared built-in corruption through inherited-key deepExtend recursion CVE-2026-63402 5.9 MediumOctober 30, 2026
• i18next i18next-http-backend i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string CVE-2026-118258 Fix available 3.7 LowOctober 28, 2026
• i18next i18next-http-backend i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl CVE-2026-115730 Fix available 2.3 LowOctober 23, 2026
• i18next i18next-http-backend i18next-http-backend incomplete URL validation permits SSRF CVE-2026-105800 Fix available 3.7 LowOctober 6, 2026
• i18next i18next-http-middleware i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names CVE-2026-48714 Fix available 9.1 CriticalJune 15, 2026
• i18next i18next-fs-backend i18next-fs-backend: Prototype pollution via crafted missing-key string CVE-2026-48713 Fix available 9.1 CriticalJune 15, 2026
• i18next i18next-http-middleware Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters CVE-2026-42353 Fix available 8.2 HighApril 29, 2026
• i18next i18next-http-middleware HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header CVE-2026-41683 Fix available 8.6 HighApril 22, 2026
• i18next i18next-fs-backend i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite CVE-2026-41693 Fix available 8.2 HighApril 22, 2026
• i18next i18nextify i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes CVE-2026-41692 Fix available 4.7 MediumApril 22, 2026
• i18next i18next-http-backend i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns CVE-2026-41691 Fix available 6.5 MediumApril 22, 2026
• i18next i18next-http-middleware Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters CVE-2026-41690 Fix available 8.6 HighApril 22, 2026
• i18next, hackerone i18next node module +1 more Cross-Site Scripting in i18next CVE-2017-16008 Fix available 6.1 MediumJune 4, 2018
• i18next, hackerone i18next node module +1 more Cross-Site Scripting in i18next CVE-2017-16010 Fix available 6.1 MediumMay 29, 2018