Threats affecting pkg:npm/i18next-http-backend

A vulnerability in i18next-http-backend prior to version 4.0.4 allows injection via unencoded language and namespace values in URL templates. This can enable an attacker to manipulate query parameters in translation resource requests, potentially exposing other namespaces or tenants or altering backend behavior. The issue is fixed in version 4.0.4.

i18next-http-backend version 4.0.2 contains an incomplete fix in the interpolateUrl() function that allows attackers to manipulate translation request URLs by supplying a namespace value starting with a slash. This can lead to loading attacker-hosted translations, enabling UI content injection and cross-site scripting (XSS). The vulnerability is fixed in version 4.0.3.

CVE-2026-105800 is a Server-Side Request Forgery (SSRF) vulnerability in the i18next-http-backend library. It occurs when an attacker controls the language or namespace input that is interpolated into the loadPath template, allowing injection of a colon character that causes the backend to request an unintended origin. This vulnerability affects versions of i18next-http-backend prior to 4.0.2 and was caused by an incomplete patch for a previous related vulnerability. The issue is fixed by rejecting colon characters in language and namespace values and ensuring URLs remain within the intended origin.

CVE-2026-41691 is a path traversal and URL injection vulnerability in i18next-http-backend versions prior to 3.0.5. The issue arises because the library interpolates language (lng) and namespace (ns) values directly into URL templates without encoding or sanitization. This allows an attacker controlling these inputs to manipulate the request URL structure, potentially accessing restricted paths. The vulnerability has been fixed in version 3.0.5. Until upgrading, users can mitigate risk by sanitizing lng and ns inputs to remove dangerous characters and limit length.