i18next-http-middleware vulnerabilities
4 known vulnerabilities in i18next-http-middleware from I18next. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
i18next-http-middleware: Improperly Controlled Modification of Object Prototype Attributes
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.
- 8.2 High severity
i18next-http-middleware: Improper Limitation of a Pathname to a Restricted Directory
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18nex
- 8.6 High severity
i18next-http-middleware: Improper Limitation of a Pathname to a Restricted Directory
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via
- 8.6 High severity
i18next-http-middleware: Improper Neutralization of Input During Web Page Generation
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after pass