i18next-http-backend

4 results · Feed

• Low 3.7
  CVE-2026-118258

  i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

  i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand …

  i18next i18next-http-backend i18next-http-backend node-i18next-http-backend Ubuntu npm
  Oct 28, 2026
• Low 3.1
  CVE-2026-115730

  i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

  i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in load…

  i18next i18next-http-backend i18next-http-backend node-i18next-http-backend Ubuntu npm
  Oct 23, 2026
• Low 3.7
  CVE-2026-105800

  i18next-http-backend incomplete URL validation permits SSRF

  i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{ln…

  i18next i18next-http-backend i18next-http-backend node-i18next-http-backend Debian Ubuntu npm
  Oct 6, 2026
• Medium 6.5
  CVE-2026-41691

  i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

  Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the con…

  i18next i18next-http-backend i18next-http-backend node-i18next-http-backend Debian npm
  May 7, 2026