I18next

10 CVEs across 5 I18next products. Browse I18next vulnerabilities, severities, and proof-of-concept exploits.

I18next products with known CVEs

ProductCVEs
I18next-Http-Middleware4
I18next2
I18next-Fs-Backend2
I18next-Http-Backend1
I18nextify1
I18next CVEs — newest first
CVESeverityScorePublishedSummary
CVE-2026-48714Critical9.12026-06-15i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missi…
CVE-2026-48713Critical9.12026-06-15Versions prior to 2.6.6 are vulnerable to prototype pollution via crafted missing-key strings when used to persist missing translation keys (e.g. via i18next-h…
CVE-2026-42353High8.22026-05-08i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-…
CVE-2026-41693High8.22026-05-08i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Prior to version 2.6.4, i18next-fs-ba…
CVE-2026-41690High8.62026-05-0818next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unaut…
CVE-2026-41683High8.62026-05-08i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-…
CVE-2026-41692Medium4.72026-05-07i18nextify is a JavaScript library that adds website internationalization via a script tag, without source code changes. Versions prior to 4.0.8 substitute {{k…
CVE-2026-41691Medium6.52026-05-07Copilot said: i18nextify is a JavaScript library that adds i18nextify is a JavaScript library that adds website internationalization via a script tag, without…
CVE-2017-16008Medium6.12018-06-04i18next is a language translation framework. Because of how the interpolation is implemented, making replacements from the dictionary one at a time, untrusted…
CVE-2017-16010Medium6.12018-05-29i18next is a language translation framework. When using the .init method, passing interpolation options without passing an escapeValue will default to undefine…