Vulnerability in I18next I18next-Http-Backend
CVE-2026-118258
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
Published .
CVSS v3 metric
CVSS v3 base score 3.7 (Low). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
- I18next I18next-Http-Backend — versions < 4.0.4
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-118258?
- CVE-2026-118258 is a low-severity vulnerability in I18next I18next-Http-Backend, classified under Improper Neutralization of Special Elements in Output Used by a Downstream Component (Injection). CVSS score: 3.7/10. Published 2026-10-28.
- How severe is CVE-2026-118258?
- Low severity. CVSS v3 base score is 3.7 out of 10.