Vulnerability · Published May 8, 2026 · Assigned by GitHub_M

CVE-2026-42353Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters

High 8.2

In plain English

A high-severity path traversal in i18next-http-middleware from i18next. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.4%top 67.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	i18next-http-middleware	3.9.3	GHSA-jfgf-83c5-2c4m

Affected products (as reported)

Vendor	Product	Versions
i18next	i18next-http-middleware	< 3.9.3

Weakness: CWE-22, CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

References

https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m x_refsource_CONFIRM