Prototype Pollution Vulnerability in i18next-http-middleware for Node.js Frameworks

CVE-2026-48714

What is CVE-2026-48714?

The i18next-http-middleware prior to version 3.9.7 contains a vulnerability where the missingKeyHandler does not adequately block certain key variants, including 'proto.polluted'. This can result in remote prototype pollution, particularly for applications that expose this handler to untrusted user input and utilize i18next-fs-backend version 2.6.5 or below. Malicious inputs can lead to corrupted translations, configuration poisoning, application crashes, or bypassing security checks. To mitigate this risk, developers should avoid exposing the missingKeyHandler publicly, implement request-body filters to reject dangerous keys, and disable persistence features for untrusted inputs.

References