Skip to main content
cve.nowby Sazabi
← npm
npmPackage

i18next-http-middleware

4 known vulnerabilities (1 critical, 3 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
4 · 1 critical, 3 high
Weekly downloads
398.1K
Registry
npm

Advisories 4

  • CVE-2026-48714Critical 9.1

    i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

    Affected: fixed in 3.9.7.

  • Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters

    Affected: fixed in 3.9.3.

  • HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header

    Affected: fixed in 3.9.3.

  • Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters

    Affected: fixed in 3.9.3.