Web Application Middleware Vulnerability in i18next by i18next

CVE-2026-41683

What is CVE-2026-41683?

The i18next-http-middleware, used in Node.js frameworks like Express and Fastify, is susceptible to an improper input validation vulnerability. Versions prior to 3.9.3 allow user-controlled language parameters to be written directly to the Content-Language response header without adequate sanitization. This occurs when utilizing older versions of the i18next library that supported backward compatibility. As a result, attackers could exploit CRLF sequences in the lng parameter, leading to potential header injection attacks. This vulnerability has been addressed in the latest version, ensuring better protection against such exploits.

References