High severity · published May 8, 2026
CVE-2026-42353
Path traversal / SSRF in i18next-http-middleware via user-controlled language and namespace parameters
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
I1
i18next-http-middleware · i18next
< 3.9.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-42353
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-42353
github.com
https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m
More from i18next-http-middleware
9.1
CVE-2026-48714
i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
8.6
CVE-2026-41683
HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
8.6
CVE-2026-41690
Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters