Cloudanix VulnDB

CVE-2026-105800

Low · 3.7

CVSS

3.7

EPSS

—

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A translation helper library could be tricked into fetching files from any internet address instead of only the intended location.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
SSRF
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

Unsanitized lng or ns values supplied to custom loadPath or addPath templates beginning with {{lng}} or {{ns}} allow colon-prefixed or double-slash inputs to resolve as absolute or protocol-relative URLs, enabling outbound requests to arbitrary origins.

Why it matters to the business

Low-likelihood server or browser requests may reach attacker-controlled destinations, risking limited information leakage or unexpected external calls; absence from KEV and low EPSS indicate minimal immediate operational disruption.

How an attack unfolds

An attacker supplies crafted language or namespace parameters containing colons or leading slashes into an application using a vulnerable custom path template; when i18next-http-backend interpolates these values at the start of the URL, the resulting request is directed outside the intended origin, achieving URL injection or SSRF.

How to fix it

Upgrade i18next-http-backend to version 4.0.2 or later; avoid custom loadPath or addPath templates whose first segment is solely a placeholder.

How to confirm the fix worked

Confirm package version is at least 4.0.2; test custom path configurations with inputs containing colons or leading slashes and verify requests remain confined to the intended origin.

Typical attack path

  1. Identify application endpoint that triggers i18next resource loading with attacker-controlled lng or ns parameters
  2. Supply malicious parameter value beginning with a scheme or double slash
  3. Induce translation fetch that resolves the injected path to an absolute or protocol-relative URL
  4. Observe or exfiltrate response from the attacker-chosen destination

How to detect it

Review application and web-server logs for translation resource requests containing unexpected schemes, external hostnames, or protocol-relative paths; inspect i18next configuration for custom paths starting with placeholders.

What your security team should do

  • Upgrade i18next-http-backend to 4.0.2 immediately
  • Audit all custom loadPath and addPath templates for leading placeholders
  • Monitor outbound HTTP requests originating from the i18next backend process

The record

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities