Read the docs
TI-2026-82145 Aliases CVE-2026-118258GHSA-3cmx-xjww-583x

Query parameter injection in i18next-http-backend via lng or ns

Priority MEDIUM 51CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 11 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Versions of i18next-http-backend before 4.0.4 insert unencoded lng and ns values into loadPath or addPath templates. Its interpolateUrl function does not reject ampersand, equals or semicolon characters, a neutralization failure (CWE-74). An attacker who controls the language or namespace value can add or override query parameters on translation requests, potentially exposing other namespaces or tenants.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0028 20th percentileScored 2026-11-07
Fix Partial i18next-http-backend (i18next): 4.0.4i18next-http-backend (npm): 4.0.4Red Hat: 11 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
i18nexti18next-http-backendbefore 4.0.44.0.4Patch availableCNA
—i18next-http-backend (npm)before 4.0.44.0.4Patch availableGHSA-3cmx-xjww-583x
  • i18next-http-backend Vendori18next Affected before 4.0.4 Fixed in 4.0.4 Patch available CNA
  • i18next-http-backend (npm) Vendor— Affected before 4.0.4 Fixed in 4.0.4 Patch available GHSA-3cmx-xjww-583x

Remediation

Upgrade i18next-http-backend to version 4.0.4. Red Hat lists Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Service Mesh 3 and other products as affected without a fix available, and Red Hat Edge Manager 1 with no fix planned.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA i18next-http-backend (i18next) Fixed in 4.0.4
  • Fix · GHSA-3cmx-xjww-583x i18next-http-backend (npm) Fixed in 4.0.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
Migration Toolkit for Applications 8AffectedNo fix yet: Fix deferred
Multicluster Engine for KubernetesAffectedNo fix yet: Fix deferred
Network Observability OperatorAffectedNo fix yet: Fix deferred
OpenShift Service Mesh 3AffectedNo fix yet: Fix deferred
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet: Fix deferred
Red Hat Ansible Automation Platform 2AffectedNo fix yet: Fix deferred
Red Hat Data Grid 8AffectedNo fix yet: Fix deferred
Red Hat Edge Manager 1AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet: Fix deferred
Red Hat OpenShift Container Platform 5AffectedNo fix yet: Fix deferred

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118258
  2. 2026-10-28 Alias added: GHSA-3cmx-xjww-583x
  3. 2026-10-28 Fix available: npm/[email protected] · GHSA-3cmx-xjww-583x
  4. 2026-10-28 CVSS score added · GHSA-3cmx-xjww-583x
  5. 2026-10-28 Weakness changed · GHSA-3cmx-xjww-583x
  6. 2026-10-28 4 new references · GHSA-3cmx-xjww-583x
  7. 2026-10-30 Affected versions changed · Red Hat
  8. 2026-10-30 CVSS score added · Red Hat
  9. 2026-10-30 Affected versions changed · Red Hat
  10. 2026-11-03 CISA SSVC decision points changed
  11. 2026-11-03 Priority changed: LOW → MEDIUM

References

Other 4

  • TI-2026-83444 Shared built-in object corruption in i18next resource merging CVSS 3.1MEDIUM 5.9
  • TI-2026-68453 Incomplete URL validation in i18next-http-backend permits SSRF CVSS 3.1LOW 3.7
  • TI-2026-35995 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names CVSS 3.1CRITICAL 9.1
  • TI-2026-35994 i18next-fs-backend: Prototype pollution via crafted missing-key string CVSS 3.1CRITICAL 9.1
  • TI-2026-79749 Protocol-relative URL injection in i18next-http-backend CVSS 4.0LOW 2.3
  • TI-2026-30208 i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns CVSS 3.1CRITICAL 9.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences