The i18next-http-middleware package for Node.js and Deno, before version 3.9.3, contains a vulnerability where unauthenticated clients can exploit two unvalidated entry points (getResourcesHandler and missingKeyHandler) to write to internal object keys, specifically polluting Object.prototype. This can lead to bypassing authorization checks (e.g., user.isAdmin returning true), type confusion denial-of-service, and potentially remote code execution if combined with vulnerable downstream code. The CVSS 3.1 score is 8.6, indicating high severity with network attack vector, no privileges required, and no user interaction needed.

An attacker can remotely exploit this vulnerability without authentication to manipulate the Node.js process's Object.prototype, potentially bypassing authorization controls, causing denial-of-service through type confusion, and possibly achieving remote code execution depending on the application’s downstream code. This can compromise confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected middleware endpoints and monitor for unusual behavior related to authorization checks. Avoid using affected versions (< 3.9.3) in production environments if possible.