CVE-2026-118258 Details
Description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
A query-parameter injection vulnerability has been identified in i18next-http-backend versions prior to 4.0.4. This issue allows an attacker to manipulate translation request parameters by injecting values through the language or namespace fields. The vulnerability arises because the interpolation function for URLs does not properly encode these values, leaving room for exploitation. When the loadPath or addPath templates include query parameters, an attacker can override existing ones or add new parameters, potentially disrupting application behavior or accessing unauthorized resources.
Users can upgrade to i18next-http-backend version 4.0.4 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510 | [email protected] | Source CodeVendor |
| https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4 | [email protected] | Release NotesVendor |
| https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-74 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| i18next-http-backend | < 4.0.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |