Priority MEDIUM 60
i18next is an internationalization framework for JavaScript.
Vulnerabilities
14 records
TI-2026-82145 CVE-2026-118258 · GHSA-3cmx-xjww-583x
Query parameter injection in i18next-http-backend via lng or ns
Priority MEDIUM 51
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno.
TI-2026-79749 CVE-2026-115730 · GHSA-9jhj-wvmw-cfx5 · GHSA-w47m-j727-m843
Protocol-relative URL injection in i18next-http-backend
Priority MEDIUM 45
i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash.
TI-2026-68453 CVE-2026-105800 · GHSA-xvq9-wjp8-hwqf
Incomplete URL validation in i18next-http-backend permits SSRF
Priority MEDIUM 51
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno.
TI-2026-35995 CVE-2026-48714 · GHSA-f49m-vf83-692w
i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
Priority MEDIUM 46
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-35994 CVE-2026-48713 · GHSA-2933-q333-qg83
i18next-fs-backend: Prototype pollution via crafted missing-key string
Priority MEDIUM 46
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g.
TI-2026-30210 CVE-2026-41693 · GHSA-8847-338w-5hcj
i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite
Priority MEDIUM 41
i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem.
TI-2026-30655 CVE-2026-42353 · GHSA-jfgf-83c5-2c4m
Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters
Priority MEDIUM 42
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30200 CVE-2026-41683 · GHSA-c3h8-g69v-pjrg
HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
Priority MEDIUM 43
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30207 CVE-2026-41690 · GHSA-5fgg-jcpf-8jjw
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
Priority MEDIUM 43
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno.
TI-2026-30208 CVE-2026-41691 · GHSA-q89c-q3h5-w34g
i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns
Priority MEDIUM 45
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.
TI-2026-30209 CVE-2026-41692 · GHSA-6457-mxpq-4fqq
i18nextify is vulnerable to DOM XSS via javascript:/data: URL schemes in translated href/src attributes
Priority LOW 21
i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes.
TI-2017-11735 CVE-2017-16008 · GHSA-f89g-whpf-6q9m
Cross-site scripting in HackerOne i18next node module
Priority LOW 29
i18next is a language translation framework.
TI-2017-11737 CVE-2017-16010 · GHSA-cmh5-qc8w-xvcq
Cross-site scripting in HackerOne i18next node module
Priority LOW 29
i18next is a language translation framework.