CVE-2026-41690

What it actually does

The vulnerability is a server-side prototype pollution flaw in 18next-http-middleware before version 3.9.3. Unauthenticated HTTP requests can reach object-key write paths in getResourcesHandler and missingKeyHandler without safely rejecting dangerous property names such as __proto__, constructor, or prototype. Because these writes occur inside the Node.js process, an attacker can modify Object.prototype for the lifetime of that process. The resulting impact depends on application code using the same process: polluted inherited properties can alter authorization or feature-flag logic, trigger type confusion, corrupt request handling, cause denial of service, or, in applications that pass polluted objects into unsafe templating, command execution, deserialization, or process-spawning paths, potentially contribute to remote code execution chains.

Why it matters to the business

A public web application using a vulnerable version may allow an unauthenticated internet user to tamper with application behavior without logging in. The most likely business consequences are authorization bypass, data integrity issues, application instability, and outages. In higher-risk deployments, especially where downstream code trusts object properties for security decisions, this could lead to account privilege escalation or be chained with other weaknesses for deeper compromise. Although the EPSS score is currently low and the issue is not listed in CISA KEV, the CVSS score is high and the flaw is remotely reachable with low complexity, so externally exposed Node.js services using this middleware should be remediated promptly.

How an attack unfolds

An attacker first identifies a Node.js application exposing 18next-http-middleware routes used for localization resource retrieval or missing-translation submission. They then send unauthenticated HTTP requests containing crafted object keys, commonly using prototype-pollution property names such as __proto__ or constructor.prototype in query parameters, path-associated values, or request bodies accepted by getResourcesHandler or missingKeyHandler. In vulnerable versions, the middleware writes those attacker-controlled keys into internal objects without blocking prototype-modifying names. This contaminates Object.prototype inside the running Node.js process. After pollution, unrelated application code may observe attacker-supplied inherited properties as if they were legitimate properties. If authorization checks, option objects, template settings, routing flags, or security controls rely on truthy object properties without using safe own-property checks, the attacker may bypass controls, corrupt behavior, crash the process, or chain the primitive into more severe outcomes.

How to fix it

Upgrade 18next-http-middleware to version 3.9.3 or later. If the package is consumed transitively, update the parent dependency or use package-manager overrides/resolutions to force a fixed version. After upgrading, rebuild and redeploy all Node.js services that bundle the library, including containers and serverless artifacts. As defense in depth, restrict missing-key submission endpoints to trusted networks or authenticated administrative workflows, disable missing-key collection in production if not required, validate and reject keys containing __proto__, prototype, or constructor, and use safe object creation and property access patterns such as Object.create(null), Map, Object.hasOwn(), or hasOwnProperty.call for security-sensitive checks. If immediate upgrade is not possible, place a web application firewall or reverse proxy rule in front of affected routes to block requests containing prototype-pollution keys, but treat this only as a temporary mitigation.

How to confirm the fix worked

Confirm that all deployed services resolve 18next-http-middleware to version 3.9.3 or later using package-lock.json, yarn.lock, pnpm-lock.yaml, npm ls, yarn why, pnpm why, SBOMs, or container image scans. Verify that no vulnerable bundled artifact remains in production images or serverless packages. Exercise application localization endpoints with benign test payloads containing blocked property names such as __proto__ and constructor.prototype in a non-production environment and confirm they are rejected or ignored and do not modify Object.prototype. Review route configuration to identify whether getResourcesHandler or missingKeyHandler is exposed publicly, especially endpoints similar to /locales/resources.json or /locales/add/:lng/:ns. Confirm production controls block unauthenticated missing-key submission unless explicitly required.

Typical attack path

1. Discover an exposed Node.js application using 18next-http-middleware localization endpoints.
2. Identify reachable getResourcesHandler or missingKeyHandler routes, commonly localization resource or missing-key submission endpoints.
3. Send unauthenticated requests containing prototype-pollution keys such as __proto__, constructor, or prototype in accepted parameters or JSON/form bodies.
4. Cause the vulnerable middleware to write attacker-controlled values into a shared JavaScript prototype.
5. Trigger application functionality that reads inherited polluted properties during authorization, request processing, rendering, or configuration handling.
6. Abuse the changed behavior to bypass checks, cause denial of service, corrupt application state, or attempt a downstream RCE chain where application code permits it.

How to detect it

Review HTTP access logs, reverse proxy logs, WAF events, CDN logs, and application request logs for requests to localization resource or missing-key endpoints containing prototype-pollution keys. Focus on unauthenticated requests to routes wired to getResourcesHandler or missingKeyHandler, commonly resource-fetch endpoints and missing-translation submission endpoints. Search query strings, JSON bodies, form bodies, and URL-encoded payloads for __proto__, constructor[prototype], constructor.prototype, prototype pollution patterns, and attempts to set security-relevant properties such as isAdmin, admin, role, authenticated, debug, shell, exec, or template options. Correlate suspicious requests with subsequent 5xx spikes, process restarts, unusual authorization successes, unexpected role changes, anomalous localization writes, or error messages indicating type confusion. Because successful pollution changes in-memory behavior rather than writing a guaranteed file artifact, absence of filesystem indicators does not rule out exploitation. If exploitation is suspected, preserve request logs and memory/process telemetry, restart affected Node.js processes after patching, and review downstream code paths that could have consumed polluted properties.

• __proto__
• %5F%5Fproto%5F%5F
• constructor.prototype
• constructor%5Bprototype%5D
• constructor[prototype]
• prototype%5B
• __proto__[isAdmin]
• __proto__%5BisAdmin%5D
• __proto__[admin]
• __proto__%5Badmin%5D
• __proto__[role]
• __proto__%5Brole%5D
• "__proto__"
• "constructor"
• /locales/resources.json
• /locales/add/
• missingKeyHandler
• getResourcesHandler

What your security team should do

• Inventory all Node.js, Express, Fastify, and Deno applications using 18next-http-middleware, including transitive dependencies and containerized builds.
• Prioritize internet-facing applications and any service where localization endpoints are exposed without authentication.
• Upgrade affected deployments to 18next-http-middleware 3.9.3 or later, then rebuild and redeploy immutable artifacts.
• Temporarily block prototype-pollution keys at the reverse proxy, WAF, or application middleware layer while upgrades are being rolled out.
• Disable or restrict missing-key submission functionality in production unless there is a clear operational need.
• Review authorization and security-sensitive code for unsafe inherited-property checks, especially logic such as if (user.isAdmin) without own-property validation.
• Search recent web access logs and application logs for prototype-pollution payloads targeting localization endpoints.
• Restart upgraded Node.js processes after remediation because prototype pollution affects in-memory process state and may persist until process restart.