VulnerabilityDeferred

CVE-2026-42353

Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF.

HIGH 8.2EPSS 0.39%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.

CVSS 3.1: 8.2 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS: 0.39% probability · 32th percentile
CISA KEV: Not listed
Weakness: CWE-22, CWE-918
Source: security-advisories@github.com

References

https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.