Vulnerability · Published Oct 6, 2026 · Assigned by GitHub_M
CVE-2026-105800i18next-http-backend incomplete URL validation permits SSRF
Low 3.7
In plain English
A low-severity injection in i18next-http-backend from i18next. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | node-i18next-http-backend | no fix listed | DEBIAN-CVE-2026-105800 |
| Debian:13 | node-i18next-http-backend | no fix listed | DEBIAN-CVE-2026-105800 |
| Debian:14 | node-i18next-http-backend | no fix listed | DEBIAN-CVE-2026-105800 |
| Ubuntu:22.04:LTS | node-i18next-http-backend | no fix listed | UBUNTU-CVE-2026-105800 |
| Ubuntu:24.04:LTS | node-i18next-http-backend | no fix listed | UBUNTU-CVE-2026-105800 |
| Ubuntu:26.04:LTS | node-i18next-http-backend | no fix listed | UBUNTU-CVE-2026-105800 |
| Ubuntu:26.10 | node-i18next-http-backend | no fix listed | UBUNTU-CVE-2026-105800 |
| npm | i18next-http-backend | 4.0.2 | GHSA-xvq9-wjp8-hwqf |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| i18next | i18next-http-backend | < 4.0.2 |
Weakness: CWE-74, CWE-918 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
References
- https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf x_refsource_CONFIRM
- https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85 x_refsource_MISC
- https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2 x_refsource_MISC