Priority MEDIUM 60
i18next is an internationalization framework for JavaScript.
i18next
Records14All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical3CVSS 9.0–10.0
CVSS high4CVSS 7.0–8.9
Exploited now
i18next records in CISA KEVNo i18next vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
14 records
TI-2026-82145 CVE-2026-118258 · GHSA-3cmx-xjww-583x
Query parameter injection in i18next-http-backend via lng or ns
Priority MEDIUM 51
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno.
TI-2026-68453 CVE-2026-105800 · GHSA-xvq9-wjp8-hwqf
Incomplete URL validation in i18next-http-backend permits SSRF
Priority MEDIUM 51
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno.
TI-2026-35995 CVE-2026-48714 · GHSA-f49m-vf83-692w
i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
Priority MEDIUM 46
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-35994 CVE-2026-48713 · GHSA-2933-q333-qg83
i18next-fs-backend: Prototype pollution via crafted missing-key string
Priority MEDIUM 46
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g.
TI-2026-79749 CVE-2026-115730 · GHSA-9jhj-wvmw-cfx5 · GHSA-w47m-j727-m843
Protocol-relative URL injection in i18next-http-backend
Priority MEDIUM 45
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash.
TI-2026-30208 CVE-2026-41691 · GHSA-q89c-q3h5-w34g
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Priority MEDIUM 45
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.
TI-2026-30207 CVE-2026-41690 · GHSA-5fgg-jcpf-8jjw
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
Priority MEDIUM 43
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30200 CVE-2026-41683 · GHSA-c3h8-g69v-pjrg
HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
Priority MEDIUM 43
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30655 CVE-2026-42353 · GHSA-jfgf-83c5-2c4m
Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters
Priority MEDIUM 42
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30210 CVE-2026-41693 · GHSA-8847-338w-5hcj
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Priority MEDIUM 41
i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem.
TI-2017-11737 CVE-2017-16010 · GHSA-cmh5-qc8w-xvcq
Cross-site scripting in HackerOne i18next node module
Priority LOW 29
i18next is a language translation framework.
TI-2017-11735 CVE-2017-16008 · GHSA-f89g-whpf-6q9m
Cross-site scripting in HackerOne i18next node module
Priority LOW 29
i18next is a language translation framework.
TI-2026-30209 CVE-2026-41692 · GHSA-6457-mxpq-4fqq
i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Priority LOW 21
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.