[ CVE-2026-105800 · Published 6 Oct 2026 ]
i18next-http-backend incomplete URL validation permits SSRF
[ Why it matters ]Priority signals
- Public proof-of-concept exploit exists (CISA SSVC)
[ Description ]Official description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
[ Fixes ]Fixes and patches
- i18next-http-backend 4.0.2Fixed version · GitHub Advisories · npm package i18next-http-backend: upgrade to 4.0.2 or later (affected < 4.0.2)
[ Advisories ]Government CERT advisories
-
CERT-FRCERTFR-2026-AVI-1336
Multiple vulnerabilities in IBM products Translated from French
Multiple vulnerabilities have been discovered in IBM products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and remote denial of service.
[ Packages ]Affected open-source packages
- i18next-http-backend npmAffected < 4.0.2 · fixed in 4.0.2 · GHSA-xvq9-wjp8-hwqf