EUVD-2026-28792Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on i18next-http-middleware (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.9.3.
DescriptionGitHub Advisory
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
AnalysisAI
Object.prototype pollution in i18next-http-middleware prior to 3.9.3 allows remote unauthenticated attackers to inject arbitrary properties into all JavaScript objects via crafted HTTP requests, bypassing authorization checks, causing type-confusion denial of service, or enabling remote code execution when chained with vulnerable downstream code. The vulnerability is actively exploitable through two unprotected API endpoints (getResourcesHandler and missingKeyHandler) that accept user-controlled language and namespace parameters without validation. EPSS data not provided, not listed in CISA KEV, but publicly disclosed with detailed GitHub security advisory including technical exploitation details.
Technical ContextAI
The vulnerability affects i18next-http-middleware, a Node.js internationalization middleware used with Express, Fastify, and Deno frameworks (CPE: cpe:2.3:a:i18next:i18next-http-middleware). The root cause is improper input validation (CWE-22: Path Traversal, though the primary issue is prototype pollution). Two code paths accept user-controlled lng and ns parameters: getResourcesHandler uses utils.setPath() which performs object property assignment without checking for dangerous keys like __proto__, constructor, or prototype; missingKeyHandler iterates POST body properties with for...in, which traverses the prototype chain. In JavaScript, writing to Object.prototype via __proto__ affects all plain objects in the process, breaking instanceof checks, authorization logic, and creating type confusion. The middleware also passes unvalidated parameters to i18next backend connectors, enabling secondary path traversal (i18next-fs-backend) or SSRF (i18next-http-backend) attacks depending on configured backend.
RemediationAI
Upgrade i18next-http-middleware to version 3.9.3 or later, which introduces prototype pollution defenses: utils.setPath now blocks __proto__, constructor, and prototype keys; missingKeyHandler replaces for...in iteration with Object.keys() plus explicit dangerous-keys validation; and a new utils.isSafeIdentifier helper provides denylist filtering. If immediate upgrade is not possible, implement compensating controls: disable or remove getResourcesHandler and missingKeyHandler endpoints if not required for application functionality (this eliminates the attack surface entirely); implement reverse proxy or WAF rules to block requests containing __proto__, constructor, or prototype in query parameters or POST body keys; add input validation middleware before i18next-http-middleware that rejects lng/ns parameters matching dangerous patterns (note: this is fragile as attackers may use URL encoding or Unicode variations); restrict backend connector access via filesystem chroot or network egress filtering to limit path traversal/SSRF impact. Trade-off: disabling handlers breaks dynamic translation resource loading and missing-key reporting features. Patch advisory and fix details: https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw.
FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se
Same weakness CWE-22 – Path Traversal
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today