I18next vulnerabilities
We track 7 vulnerabilities in I18next products across 3 products. 7 are rated high or critical, and none are known to be exploited. The most recent was published on June 15, 2026.
Latest I18next vulnerabilities
- 9.1 Critical severity
i18next-http-middleware: Improperly Controlled Modification of Object Prototype Attributes
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.
- 9.1 Critical severity
i18next-fs-backend: Improperly Controlled Modification of Object Prototype Attributes
Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input). Backend.writeFile() splits each queue
- 8.2 High severity
i18next-http-middleware: Improper Limitation of a Pathname to a Restricted Directory
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18nex
- 8.2 High severity
i18next-fs-backend: Improper Limitation of a Pathname to a Restricted Directory
i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-backend substitutes the lng and ns options directly into the configured loadPath / addPath templates an
- 8.6 High severity
i18next-http-middleware: Improper Limitation of a Pathname to a Restricted Directory
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via
- 8.6 High severity
i18next-http-middleware: Improper Neutralization of Input During Web Page Generation
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after pass
- 9.1 Critical severity
i18next-http-backend: Improper Limitation of a Pathname to a Restricted Directory
Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 3.0.5 interpolate the lng and ns values directly into the conf