i18next-http-middleware CVE-2026-41690

Exploitation requires the Node.js application to expose either the getResourcesHandler endpoint (typically mounted at routes like /locales/resources.json) or the missingKeyHandler POST endpoint as part of its i18next-http-middleware configuration. Default i18next-http-middleware installations often enable these handlers for dynamic translation loading and missing-key reporting, making the vulnerability broadly exploitable across typical deployments. No authentication, user interaction, or non-default configuration is required - remote unauthenticated exploitation succeeds against standard configurations (CVSS PR:N/UI:N). Attack vector is network-accessible HTTP (AV:N) with low complexity (AC:L). Limiting factors: applications that do not mount these specific handler endpoints are not vulnerable; exploitation impact severity varies based on how downstream application code uses Object.prototype properties (authorization checks, type checks, configuration lookups); path traversal and SSRF impacts require specific backend connectors (i18next-fs-backend or i18next-http-backend) to be configured.

High real-world risk driven by CVSS 8.6 score with network vector, low complexity, and no authentication required (AV:N/AC:L/PR:N/UI:N). The vulnerability enables direct compromise of application authorization logic through prototype pollution - a single GET request can make all user.isAdmin checks return true. Attack complexity is genuinely low: exploitation requires only crafting a URL with __proto__ as a parameter value, no special tools or timing. High integrity impact (I:H) reflects authorization bypass and potential RCE chain; low confidentiality (C:L) and availability (A:L) impacts understate the DoS potential from unbounded namespace growth and memory exhaustion. The GitHub security advisory provides detailed technical description including exact vulnerable code paths, significantly lowering exploitation barrier despite no confirmed public POC. Path traversal and SSRF secondary impacts depend on backend configuration, adding deployment-specific risk variability. Priority is elevated by the unauthenticated remote attack surface and the fact that authorization bypass affects the entire Node.js process, not just the i18next component. Mitigating factor: exploitation requires the application to expose the vulnerable getResourcesHandler or missingKeyHandler endpoints, which may not be enabled in all deployments.

An unauthenticated attacker sends GET request to /locales/resources.json?lng=__proto__&ns=isAdmin targeting an Express application using i18next-http-middleware below 3.9.3. The getResourcesHandler accepts these parameters and calls utils.setPath(resources, ['__proto__', 'isAdmin'], true), writing Object.prototype.isAdmin = true. Subsequently, any authorization check in the application using if (user.isAdmin) evaluates to true for all users, including anonymous sessions, because all objects now inherit isAdmin: true from the polluted prototype. The attacker gains administrative access to protected endpoints, modifies application data, or chains this with other vulnerabilities that check polluted properties to achieve remote code execution. Detailed GitHub security advisory provides exploitation paths and code-level analysis.