Skip to content
OpenAdvisories

Vendor

i18next

12 known vulnerabilities.

Products

i18next-http-middleware 4 i18next-http-backend 4 i18next-fs-backend 2 i18next 1 i18nextify 1
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-63402

    i18next: Shared built-in corruption through inherited-key deepExtend recursion

    i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must e…

    i18next i18next node-i18next node-i18next Debian Ubuntu
  • Medium 6.5
    CVE-2026-41691

    i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

    Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the con…

    i18next i18next-http-backend i18next-http-backend node-i18next-http-backend Debian npm
  • Medium 4.7
    CVE-2026-41692

    i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes

    i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{key}} interpolation tokens inside src and href attribute values with the raw string returned by i18ne…

    i18next i18nextify i18nextify npm