i18next

Products

Exploited and recent CVEs

• CVE-2026-63402 Medium 5.9 i18next: Shared built-in corruption through inherited-key deepExtend recursion 0.3%
• CVE-2026-118258 Low 3.7 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string 0.3%
• CVE-2026-115730 Low 3.1 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl 0.3%
• CVE-2026-105800 Low 3.7 i18next-http-backend incomplete URL validation permits SSRF 0.3%
• CVE-2026-48714 Critical 9.1 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names 0.5%
• CVE-2026-48713 Critical 9.1 i18next-fs-backend: Prototype pollution via crafted missing-key string 0.5%
• CVE-2026-41693 High 8.2 i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite 0.3%
• CVE-2026-42353 High 8.2 Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters 0.4%
• CVE-2026-41683 High 8.6 HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header 0.3%
• CVE-2026-41690 High 8.6 Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters 0.3%
• CVE-2026-41691 Medium 6.5 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns 0.3%
• CVE-2026-41692 Medium 4.7 i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes 0.1%