CVE-2026-41690 Details
Description
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
A prototype pollution vulnerability has been identified in i18next-http-middleware versions prior to 3.9.3. This vulnerability allows an unauthenticated HTTP client to manipulate Object.prototype in the Node.js process running the middleware. The issue arises from two unvalidated entry points, 'getResourcesHandler' and 'missingKeyHandler', which write internal object keys without proper validation. Exploiting this vulnerability can disrupt authorization checks, cause type-confusion denial-of-service, and potentially lead to remote code execution, depending on the downstream code.
Users are advised to upgrade to i18next-http-middleware version 3.9.3 or later. The patched version blocks prototype-related keys in the 'getResourcesHandler' and 'missingKeyHandler' functions, preventing the pollution of Object.prototype. For those unable to upgrade, a partial mitigation can be applied by front-proxying the middleware with a Web Application Firewall rule that rejects requests containing prototype-related keys in the 'lng' or 'ns' query parameters or in the request body.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1321 | Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') | [email protected] |
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| i18next-http-middleware | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |