PT-2026-37151 · Npm · I18Next-Http-Backend

Adraicommitted

·

Published

2026-04-22

·

Updated

2026-06-12

·

CVE-2026-41691

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions i18next-http-backend versions prior to 3.0.5
Description Versions of the library interpolate the lng and ns values directly into the configured loadPath or addPath URL templates without encoding, validation, or path sanitization. When language-code selection is exposed to user-controlled input—such as through query parameters, cookies, localStorage, or request headers—an attacker can inject characters to alter the structure of the outgoing request URL. This can lead to path traversal, query-string injection, and fragment truncation. In severe cases, this may result in Server-Side Request Forgery (SSRF) if the loadPath uses internal or file-scheme URLs, or path-based authorization bypass. Additionally, the software was susceptible to log forging via control characters in lng or ns, leakage of Basic-auth credentials in error callbacks, and prototype pollution amplification due to the use of for...in loops in addQueryString and customHeaders.
Recommendations Update to version 3.0.5. As a temporary workaround, sanitize lng and ns values before they reach the library by stripping .., /, ``, ?, #, %, whitespace, and control characters, and by capping the length of the input.

Fix

Special Elements Injection

Path traversal

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

CVE-2026-41691
GHSA-Q89C-Q3H5-W34G

Affected Products

I18Next-Http-Backend