CVE-2026-42353

8.2 highEPSS 0.4%

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware passes the user-controlled lng and ns values from getResourcesHandler directly into i18next.services.backendConnector.load(languages, namespaces, …) without any sanitization. Depending on which backend is configured, the unvalidated path segments enable either path traversal or SSRF. This issue has been patched in version 3.9.3.

CVSS 3.1: 8.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
EPSS: 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-26)
CWEs: CWE-22, CWE-918
Published: 2026-05-08
Modified: 2026-10-26
Record from: the NVD, synced 2026-10-26

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-jfgf-83c5-2c4m	npm	i18next-http-middleware	<3.9.3	3.9.3

References

https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m

Check your stack JSON