CVE-2026-41690
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
CVSS Score
8.6
EPSS Score
0.0%
EPSS Percentile
0th
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
| CWE | CWE-22 CWE-1321 |
| Vendor | i18next |
| Product | i18next-http-middleware |
| Published | May 8, 2026 |
| Last Updated | May 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for i18next i18next-http-middleware
Be the first to know when new high vulnerabilities affecting i18next i18next-http-middleware are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
High
Availability
Low
Affected Versions
i18next / i18next-http-middleware
< 3.9.3