PT-2026-36113 · Npm · I18Next-Http-Middleware+2

Published 2026-04-29 · Updated 2026-05-08 · CVE-2026-42353

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.3

Description The software passes user-controlled lng and ns values from the getResourcesHandler function directly into i18next.services.backendConnector.load(languages, namespaces, …) without sanitization. Depending on the configured backend, this can lead to different security issues:

• Filesystem path traversal (reading arbitrary files from disk) when paired with i18next-fs-backend or similar filesystem-based backends.
• Server-Side Request Forgery (SSRF), which allows requests to internal IPs or hostnames, when paired with i18next-http-backend or similar HTTP-based backends.
• Memory exhaustion due to the unbounded growth of the i18next.options.ns array when repeated unique payloads are sent.

Recommendations Update to version 3.9.3 or later.

Fix

Path traversal

SSRF

Weakness Enumeration

CWE-22

CWE-918

Related Identifiers

CVE-2026-42353

GHSA-JFGF-83C5-2C4M

Affected Products

I18Next-Fs-Backend

I18Next-Http-Backend

I18Next-Http-Middleware

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-42353 · Security Note
• https://osv.dev/vulnerability/GHSA-jfgf-83c5-2c4m · Vendor Advisory
• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m · Note
• https://github.com/i18next/i18next-http-middleware · Note
• https://twitter.com/CVEnew/status/2052810974617342345 · Twitter Post
• https://i18next.com/how-to/faq#how-should-the-language-codes-be-formatted · Note
• https://reddit.com/r/VulnMatter/comments/1szui9p/resumen_diario_de_vulnerabilidades_30042026 · Reddit Post
• https://t.me/CVEtracker/53130 · Telegram Post