Skip to content
OpenAdvisories

Vendor

i18next

12 known vulnerabilities.

Products

i18next-http-middleware 4 i18next-http-backend 4 i18next-fs-backend 2 i18next 1 i18nextify 1
All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Critical 9.1
    CVE-2026-48714

    i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

    i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3…

    i18next i18next-http-middleware i18next-http-middleware npm
  • Critical 9.1
    CVE-2026-48713

    i18next-fs-backend: Prototype pollution via crafted missing-key string

    Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queu…

    i18next i18next-fs-backend i18next-fs-backend npm