TI-2026-30200 Aliases CVE-2026-41683 GHSA-c3h8-g69v-pjrg

HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header

MEDIUM 43CWE-113Published 2026-05-08 · Updated 2026-05-08

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · High · Low
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00327 25th percentileScored 2026-11-07

Fix Fixed i18next-http-middleware (i18next): 3.9.3i18next-http-middleware (npm): 3.9.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
i18next	i18next-http-middleware	before 3.9.3	3.9.3	Patch available	CNA
—	i18next-http-middleware (npm)	before 3.9.3	3.9.3	Patch available	GHSA-c3h8-g69v-pjrg

i18next-http-middleware Vendori18next Affected before 3.9.3 Fixed in 3.9.3 Patch available CNA
i18next-http-middleware (npm) Vendor— Affected before 3.9.3 Fixed in 3.9.3 Patch available GHSA-c3h8-g69v-pjrg

Remediation

Fix · CNA i18next-http-middleware (i18next) Fixed in 3.9.3
Fix · GHSA-c3h8-g69v-pjrg i18next-http-middleware (npm) Fixed in 3.9.3 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-41683
2026-10-03 Alias added: GHSA-c3h8-g69v-pjrg

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-41683

Other 3

TI-2026-83444 Shared built-in object corruption in i18next resource merging CVSS 3.1MEDIUM 5.9
TI-2026-82145 Query parameter injection in i18next-http-backend via lng or ns CVSS 3.1LOW 3.7
TI-2026-68453 Incomplete URL validation in i18next-http-backend permits SSRF CVSS 3.1LOW 3.7
TI-2026-35995 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names CVSS 3.1CRITICAL 9.1
TI-2026-35994 i18next-fs-backend: Prototype pollution via crafted missing-key string CVSS 3.1CRITICAL 9.1
TI-2026-79749 Protocol-relative URL injection in i18next-http-backend CVSS 4.0LOW 2.3

See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences