Cloudanix VulnDB

CVE-2026-118258

Low · 3.7

CVSS

3.7

EPSS

0.3%

Published

Oct 28, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A language-handling library in web applications could let attackers tamper with requests that fetch translations, potentially exposing extra content.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Data Exposure
Component
Library
Class
Improper Input Validation
Remediation
Upgrade
Effort
Low
Patch risk
Low

What it actually does

The flaw permits unencoded lng or ns values containing query separators (&, =, ;) to be inserted into loadPath or addPath templates, enabling parameter injection or override on translation resource requests.

Why it matters to the business

Attackers may reach additional translation namespaces or tenants and alter backend behavior using the application's network position, potentially exposing localized content or configuration in multilingual applications.

How an attack unfolds

An attacker who can influence the language or namespace value supplied to the library crafts it to include query separators; when the application performs a translation load the resulting URL carries injected parameters that reach the backend with the application's credentials.

How to fix it

Upgrade i18next-http-backend to version 4.0.4 or later; verify that lng and ns values are properly encoded before insertion into URL templates.

How to confirm the fix worked

Confirm the installed package version is 4.0.4 or newer; test that special characters supplied in language or namespace fields appear percent-encoded in outgoing translation requests.

Typical attack path

  1. Locate an application using a vulnerable version of i18next-http-backend
  2. Supply a crafted lng or ns value containing & = or ; characters
  3. Trigger a translation resource load so the injected parameters reach the backend

How to detect it

Inspect server or proxy logs for translation requests whose query strings contain unexpected parameters or lng/ns values that include literal & = or ; characters.

What your security team should do

  • Upgrade to 4.0.4 or later within the next maintenance window
  • Audit all i18next configurations that place lng or ns into query strings
  • Add input validation or encoding around language and namespace parameters

The record

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities