Vulnerability · Published Oct 28, 2026 · Assigned by GitHub_M

CVE-2026-118258i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Low 3.7

In plain English

A low-severity injection in i18next-http-backend from i18next. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Ubuntu:22.04:LTS	node-i18next-http-backend	no fix listed	UBUNTU-CVE-2026-118258
Ubuntu:24.04:LTS	node-i18next-http-backend	no fix listed	UBUNTU-CVE-2026-118258
Ubuntu:26.04:LTS	node-i18next-http-backend	no fix listed	UBUNTU-CVE-2026-118258
Ubuntu:26.10	node-i18next-http-backend	no fix listed	UBUNTU-CVE-2026-118258
npm	i18next-http-backend	4.0.4	GHSA-3cmx-xjww-583x

Affected products (as reported)

Vendor	Product	Versions
i18next	i18next-http-backend	< 4.0.4

Weakness: CWE-74 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x x_refsource_CONFIRM
https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510 x_refsource_MISC
https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4 x_refsource_MISC