JavaScript Internationalization Framework Vulnerability in i18next

CVE-2026-63402

What is CVE-2026-63402?

The i18next framework for internationalization in JavaScript contains a vulnerability wherein the 'deepExtend' method can be exploited if attacker-controlled data is passed into the 'addResourceBundle' function with both 'deep: true' and 'overwrite: true'. This configuration allows malicious users to overwrite properties of global built-in functions through nested objects, potentially leading to a denial of service by making critical functions non-callable. It is noteworthy that the misuse of inheritance via 'Object.prototype' is central to this exploit. However, default configurations of i18next do not utilize this insecure setup, and the issue has been addressed in version 26.3.4.

References