CVE-2026-42353 Details
Description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.
A vulnerability in i18next-http-middleware versions prior to 3.9.3 allows for path traversal or server-side request forgery (SSRF) attacks. The middleware passes user-controlled language and namespace values directly to the i18next backend connector without proper sanitization. This oversight can be exploited depending on the configured backend: with i18next-fs-backend, it enables unauthorized file access, while with i18next-http-backend, it allows requests to internal services that could lead to credential theft.
Users are advised to upgrade to i18next-http-middleware version 3.9.3 or later. Additionally, upgrading the backend to i18next-fs-backend version 2.6.4 or i18next-http-backend version 3.0.5 will also mitigate the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 8, 2026CISA-ADP
Assessed May 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m | [email protected] | AdvisoryBundleRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| i18next-http-middleware | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 8, 2026 | New CVE Received | [email protected] |