Prototype Pollution Vulnerability in i18next-fs-backend by i18next
CVE-2026-48713

9.1CRITICAL

Key Information:

Vendor

I18next

Status
I18next-fs-backend
Vendor
CVE Published:
15 June 2026

What is CVE-2026-48713?

An exploitable prototype pollution vulnerability exists in the i18next-fs-backend versions prior to 2.6.6. This issue arises from the mishandling of crafted missing-key strings, leading to potential manipulation of the Object.prototype. Attackers can exploit this weakness when the missingKeyHandler is exposed to untrusted input, permitting arbitrary properties to be written on the global object prototype. Consequences may include application crashes, faulty translations, configuration corruption, or circumvention of security measures. To mitigate risks, developers should either upgrade to version 2.6.6, restrict access to the missingKeyHandler, disable missing-key persistence, or disable key splitting in their i18next configurations.

Affected Version(s)

i18next-fs-backend < 2.6.6

References

https://github.com/i18next/i18next-fs-backend/security/ad...
x_refsource_CONFIRM
https://github.com/i18next/i18next-fs-backend/commit/3ab0...
x_refsource_MISC

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.