CVE-2026-105800 in i18next-http-backend
Summary
by MITRE • 10/06/2026
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The i18next-http-backend library serves as a critical component for internationalization applications, facilitating the loading of translation resources across various runtime environments including Node.js, browsers, and Deno. A significant security vulnerability was identified in versions prior to 4.0.2 concerning how user-supplied input is handled during URL construction. Specifically, when an attacker controls language or namespace values that are interpolated into a custom loadPath or addPath configuration template starting directly with the placeholders for language {{lng}} or namespace {{ns}}, they can manipulate the resulting request structure. This flaw allows colon-based inputs to be interpreted as absolute URLs rather than relative path segments, effectively breaking out of the intended origin context.
In browser environments, this vulnerability extends further by allowing double-slash namespaces to function as protocol-relative URLs. When such manipulated values are processed, the application may initiate requests that bypass same-origin policy restrictions or target unintended external domains. This behavior creates a vector for URL injection and server-side request forgery attacks. The core technical flaw lies in the lack of strict validation on the structural position of user-controlled variables within the path template; if these variables appear at the very beginning of the constructed string, they can dictate the protocol scheme or absolute address rather than serving as mere directory names.
The impact of this vulnerability is severe for applications relying on dynamic translation loading without proper sanitization. Attackers could potentially exfiltrate data by forcing requests to malicious endpoints controlled by them, or exploit trust relationships with other services if the application interacts with internal APIs using similar patterns. This constitutes a classic case of improper input validation leading to unauthorized network access and potential data leakage. The vulnerability is categorized under CWE-20 Improper Input Validation and aligns with ATT&CK techniques related to Server-Side Request Forgery, as it enables an attacker to influence the destination of server-initiated or client-side requests based on crafted input parameters.
Mitigation strategies primarily involve upgrading to version 4.0.2 or later where this issue has been resolved through improved handling of interpolated values. For environments that cannot immediately upgrade, developers should ensure that loadPath templates do not begin directly with {{lng}} or {{ns}} placeholders without a preceding static path segment or origin prefix. By ensuring the placeholder does not occupy the structural beginning of the URL string, such as using /locales/{{lng}}/{{ns}}.json instead of just {{lng}}/{{ns}}, the risk is mitigated because the browser and server will interpret the result as a relative path rather than an absolute address. Additionally, implementing strict allowlists for language and namespace values can provide defense in depth by preventing unexpected characters like colons from entering the interpolation process entirely.