The i18next-http-middleware package for Node.js and Deno prior to version 3.9.7 contains a prototype pollution vulnerability (CWE-1321) in its missingKeyHandler. Although literal keys __proto__, constructor, and prototype are blocked since version 3.9.3, dotted variants such as "__proto__.polluted" are not rejected. Downstream backends like i18next-fs-backend ≤ 2.6.5 that split the missing key string on a configured keySeparator and use an unguarded setPath() function to write to Object.prototype are vulnerable to remote prototype pollution. This vulnerability can be exploited if the application exposes missingKeyHandler to untrusted input and uses affected downstream backends. The impact includes potential application crashes, corrupted translation data, configuration poisoning, or security bypasses. The vulnerability is fixed in i18next-http-middleware version 3.9.7.

Exploitation allows remote attackers to perform prototype pollution via crafted missing-key strings containing dotted variants of __proto__, constructor, or prototype. This can lead to application crashes, corrupted translation behavior, configuration poisoning, or bypass of property-based security controls depending on the host application and backend usage. There is no confidentiality impact reported. The CVSS v3.1 score is 9.1 (critical) with network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on integrity and availability.

A fixed version 3.9.7 of i18next-http-middleware is available and should be applied to remediate this vulnerability. If immediate upgrade is not possible, developers should ensure missingKeyHandler is not exposed to untrusted users by mounting it behind authentication or removing the route. Additionally, implement a request-body filter that rejects any top-level keys containing __proto__, constructor, or prototype after splitting on the configured keySeparator. Also, disable missing-key persistence by setting saveMissing to false when accepting writes from untrusted input. These mitigations reduce exposure until the official fix can be applied.