Injection Vulnerability in i18next-http-backend by i18next
CVE-2026-118258

3.7LOW

Key Information:

Vendor

I18next

Status
I18next-http-backend
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118258?

The i18next-http-backend prior to version 4.0.4 is vulnerable to an injection issue where unencoded language and namespace values can be injected into loadPath or addPath templates. If an attacker controls these values in the query string, they can manipulate translation requests, expose sensitive data across namespaces, or alter backend functionality through the application's network configuration. This vulnerability stems from an incomplete fix of a previous issue, potentially compromising application security.

Affected Version(s)

i18next-http-backend < 4.0.4

References

https://github.com/i18next/i18next-http-backend/security/...
x_refsource_CONFIRM
https://github.com/i18next/i18next-http-backend/commit/b0...
x_refsource_MISC
https://github.com/i18next/i18next-http-backend/releases/...
x_refsource_MISC

CVSS V3.1

Score:
3.7
Severity:
LOW
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.