Vulnerability · Published May 8, 2026 · Assigned by GitHub_M
CVE-2026-41683HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
High 8.6
In plain English
A high-severity cross-site scripting in i18next-http-middleware from i18next. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 26% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | i18next-http-middleware | 3.9.3 | GHSA-c3h8-g69v-pjrg |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| i18next | i18next-http-middleware | < 3.9.3 |
Weakness: CWE-79, CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L