CVE-2026-41690: falha de alta gravidade em i18next-http-middleware
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.6epss 0.5%
probabilidade de exploração
0.5%top 62% das CVEs
exploração observada
nãonenhuma fonte reporta
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
i18next · i18next-http-middlewareCVEs relacionadas — i18next-http-middleware
No mesmo produto, das mais perigosas para as menos.
CVE-2026-48714CRITICALi18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting namesEPSS 0.7%CVE-2026-42353HIGHPath traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parametersEPSS 0.4%CVE-2026-41683HIGHHTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language headerEPSS 0.4%