CVE Intelligence
Analysis AI-assisted

CVE-2026-41691: i18next-http-backend Path Traversal and URL Injection via lng/ns

Versions of i18next-http-backend before 3.0.5 insert lng and ns values into loadPath and addPath URL templates without encoding, validation or path sanitisation, which enables path traversal and URL structure injection (CWE-22). NVD rates it 9.1 (critical) and GitHub rates it 6.5. The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The weakness concerns how i18next-http-backend builds resource URLs from the lng (language) and ns (namespace) values. These values are placed into the loadPath and addPath templates without encoding, validation or path sanitisation, so input that an attacker can influence may change the structure of outgoing requests. The record classifies the weakness as CWE-22 (Path Traversal).

Impact

  • Requests may be directed to unintended paths or URL structures on the target origin. This is an inference from the description.
  • The NVD vector reports high confidentiality and integrity impact and no availability impact.
  • Real-world consequences depend on how the application exposes language selection and what the backend serves at the resulting paths. The sources do not describe this.

Affected products and versions

  • Product: I18next I18next-http-backend.
  • Affected: versions before 3.0.5.
  • Fixed in: 3.0.5.
  • The description refers to i18nextify, a name that does not appear in the affected product list. The sources do not explain the relationship.

Exploitation status

  • The record shows the CVE is not listed in CISA KEV.
  • No confirmed exploitation appears in the sources consulted.
  • The SSVC record shows exploitation as none and automatable as yes. The EPSS probability is 0.00313 with a percentile of 0.23058.

Remediation and mitigation

  • Upgrade i18next-http-backend to 3.0.5 or later, as described in the GitHub security advisory and the fix commit.
  • If an immediate upgrade is not possible, validate lng and ns against an allowlist of expected language codes and namespaces before they reach i18next. Reject or normalise values containing path separators, query or fragment characters, percent signs, whitespace, control characters, or excessive length. The advisory describes this as a temporary workaround.
  • Review whether language selection taken from query parameters, cookies, storage or request headers is exposed to untrusted users.

Detection guidance

  • Log and review requests whose language or namespace parameters contain unexpected characters or unusual length.
  • Monitor for resource requests to unexpected paths under the application origin.

Limitations of the available information

  • NVD assigns 9.1 and GitHub assigns 6.5. The record does not explain the difference.
  • The affected version list contains two expressions for the same range.
  • The record does not describe real-world attacks or public proof-of-concept material.
  • This analysis did not review the contents of the fix commit. The description of the fix comes from the record.
  • The relationship between i18nextify and i18next-http-backend is not established by the record.

Frequently asked questions

Which version fixes CVE-2026-41691?

The record states the issue is fixed in i18next-http-backend 3.0.5. Versions before 3.0.5 are affected.

Is this vulnerability known to be exploited?

The record does not list it in CISA KEV, and no confirmed exploitation appears in the sources consulted. The EPSS probability is 0.00313.

What can I do if I cannot upgrade right away?

Validate lng and ns against expected values before they reach i18next and limit their length. The advisory describes this as a temporary workaround.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.