CVE-2026-41690: fallo de gravedad alta en i18next-http-middleware
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.6epss 0.5%
probabilidad de explotación
0.5%top 62% de las CVE
explotación observada
noninguna fuente lo reporta
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Productos afectados
i18next · i18next-http-middlewareCVEs relacionadas — i18next-http-middleware
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-48714CRITICALi18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesEPSS 0.7%CVE-2026-42353HIGHPath traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parametersEPSS 0.4%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.4%