CVE-2026-42353: fallo de gravedad alta en i18next-http-middleware
Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters
Publicada el
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 8.2epss 0.4%
probabilidad de explotación
0.4%top 64% de las CVE
explotación observada
noninguna fuente lo reporta
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Productos afectados
i18next · i18next-http-middlewareCVEs relacionadas — i18next-http-middleware
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-48714CRITICALi18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesEPSS 0.7%CVE-2026-41690HIGHPrototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parametersEPSS 0.5%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.4%