CVE Intelligence
Analysis AI-assisted

CVE-2026-48714: i18next-http-middleware missingKeyHandler prototype pollution via dotted keys

The missingKeyHandler in i18next-http-middleware before 3.9.7 blocks literal prototype-related keys but not dotted variants, which some downstream backends split and write into Object.prototype. The record describes direct exploitability where the handler is exposed to untrusted input and i18next-fs-backend 2.6.5 and earlier is used. The fix is an upgrade to 3.9.7, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

CVE-2026-48714 affects the missingKeyHandler of i18next-http-middleware, a middleware used with Node.js frameworks such as express and Fastify, and with Deno. The weakness is classified as CWE-1321 (Prototype Pollution). The handler rejected the literal keys __proto__, constructor and prototype, but according to the record it did not reject dotted variants of these names.

Impact

The record states that downstream backends that split the missing-key string on a configured keySeparator can pass such keys to an unguarded path-setting routine that writes to Object.prototype. Depending on the host application, the record lists possible outcomes: crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. The CVSS 3.1 base score of 9.1 is listed by the GitHub CNA and by a second provider, with integrity and availability impact rated high and no confidentiality impact in the vector.

Affected products and versions

  • i18next-http-middleware: before 3.9.7 (per the record's affected entries).
  • i18next-fs-backend: 2.6.5 and earlier is named in the record as a downstream backend that splits missing-key strings in the affected way.
  • The record notes that other downstream backends that split the string the same way may be similarly affected, but does not name them.

Exploitation status

The CISA KEV catalogue does not list this CVE in the record, and the record shows an SSVC exploitation value of none. No confirmed exploitation in the wild appears in the sources consulted. The EPSS probability is 0.00657 with a percentile of 0.50859, which are estimates and not evidence of exploitation.

Remediation and mitigation

  • Upgrade i18next-http-middleware to 3.9.7 or later, as stated in the record. The fix commit is referenced by the record.
  • If an immediate upgrade is not possible, do not expose missingKeyHandler to untrusted users; place it behind authentication or remove the route.
  • Add a request-body filter ahead of the handler that rejects top-level keys containing the prototype-related names after splitting on the configured keySeparator. This is a defensive measure described in the record.
  • Disable missing-key persistence (saveMissing set to false) when accepting writes from untrusted input.
  • Review whether any downstream backend in use splits missing-key strings in the same way, since the record says others may be affected.

Detection guidance

  • Review application and proxy logs for unusual request bodies sent to the missing-key handling route, particularly keys containing prototype-related names or dot separators.
  • Monitor for unexpected properties appearing on built-in object prototypes or unexplained application crashes and translation anomalies after requests to that route.
  • Inventory which applications use i18next-http-middleware and i18next-fs-backend and their versions, so exposure can be assessed quickly.

Limitations of the available information

The record does not state the exact set of affected downstream backends beyond i18next-fs-backend 2.6.5 and earlier. It does not describe the specific host applications where impact was confirmed, and it does not include a proof of concept or independent verification. The record lists an EPSS date of 2026-10-23, which is not explained further. Information on whether 3.9.7 fully addresses all downstream variants is not stated in the record.

Frequently asked questions

What is the core weakness in CVE-2026-48714?

According to the record, the handler blocked literal prototype-related keys but not dotted variants, and some downstream backends could write those keys into Object.prototype.

Which version fixes the issue?

The record states the issue is fixed in version 3.9.7 of i18next-http-middleware.

Is there confirmed exploitation?

The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.