All vulnerabilities
CVE-2026-115730CVE-2026-105800GHSA-9jhj-wvmw-cfx5GHSA-xvq9-wjp8-hwqf

i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

i18next i18next-http-backendnpmLibraries & packages
Open in ThreatlineRecord JSON
CVSS
2.3Low
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in4.0.3Also 4.0.2CVE List
Published23 Oct 2026Updated 23 Oct 2026CVE List

What fixes it

  • 4.0.3i18next-http-backendCVE List
  • 4.0.2i18next-http-backend, npmOSVnpm install i18next-http-backend@4.0.2

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Text from CVE List

Affected versions 2

  • i18next-http-backendaffected: 4.0.2 before 4.0.3CVE List
  • i18next-http-backend, npmfrom first release, fixed in 4.0.2OSV

References 4