Versions of i18next-http-backend prior to 3.0.5 improperly interpolate user-controlled language (lng) and namespace (ns) values into URL path templates without encoding or validation. This allows attackers to perform path traversal, query-string injection, fragment truncation, and URL-encoded bypasses, potentially leading to SSRF or authorization bypass in certain server configurations. The issue is fixed in version 3.0.5, which adds strict URL segment validation and other security hardenings.