Threats affecting pkg:npm/i18next

CVE-2026-63402 is a vulnerability in the i18next JavaScript internationalization framework prior to version 26.3.4. It involves the `deepExtend` function improperly recursing into inherited built-in objects via the `in` operator, allowing an attacker to overwrite properties of shared built-in functions process-wide when specific parameters are used. This can cause unrecoverable denial of service by making functions like `hasOwnProperty` non-callable. The issue is fixed in version 26.3.4.