The vulnerability exists in i18next-http-middleware, a Node.js middleware for internationalization, where user input parameters 'lng' and 'ns' are not sanitized before being used in backend resource loading calls. This improper limitation of pathname (CWE-22) and potential SSRF (CWE-918) can be exploited to access unauthorized files or resources. The flaw affects all versions before 3.9.3 and has been addressed by the vendor in that release.

Successful exploitation can lead to unauthorized access to files or resources outside the intended directory structure (path traversal), or cause the server to make unintended requests (SSRF). The CVSS score of 8.2 reflects a high impact on confidentiality with limited impact on integrity and no impact on availability. There are no reports of active exploitation in the wild.

Upgrade i18next-http-middleware to version 3.9.3 or later, where the vulnerability is patched. Since this is a self-hosted middleware component, users must apply the update themselves. Patch status is confirmed by the vendor advisory indicating the fix in version 3.9.3. No additional mitigations are specified.