i18next up to 26.3.3 Deep Merge src/utils.js deepExtend deep/overwrite dynamically-managed code resources

Summaryinfo

A vulnerability classified as problematic has been found in i18next up to 26.3.3. This impacts the function deepExtend of the file src/utils.js of the component Deep Merge. The manipulation of the argument deep/overwrite leads to dynamically-managed code resources. This vulnerability is traded as CVE-2026-63402. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in i18next up to 26.3.3 and classified as problematic. This issue affects the function deepExtend of the file src/utils.js of the component Deep Merge. The manipulation of the argument deep/overwrite with an unknown input leads to a dynamically-managed code resources vulnerability. Using CWE to declare the problem leads to CWE-913. The product does not properly restrict reading from or writing to dynamically-managed code resources such as variables, objects, classes, attributes, functions, or executable instructions or statements. Impacted is integrity, and availability. The summary by CVE is:

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-63402 since 07/16/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available.

Upgrading to version 26.3.4 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Name

• i18next

Version

• 26.3.0
• 26.3.1
• 26.3.2
• 26.3.3

Website

• Product: https://github.com/i18next/i18next/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion