i18next-fs-backend CVE-2026-48713

Exploitation requires that the target application (1) mounts i18next-http-middleware's missingKeyHandler - or any other route that forwards untrusted request bodies into i18next.t with saveMissing: true and a backend.create implementation - and exposes it to attacker-reachable input without authentication, AND (2) runs with the default keySeparator ('.') rather than keySeparator: false. The attacker must be able to control the missing-key string so that segments such as '__proto__', 'constructor', or 'prototype' reach Backend.writeFile(). Apps that gate missingKeyHandler behind authentication, disable saveMissing, or set keySeparator: false are not exploitable through this path; the CVSS PR:N rating is therefore optimistic and assumes the worst-case default deployment of the middleware.

The published CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H (9.1) treats the bug as a remote, unauthenticated high-impact integrity/availability flaw, which is plausible for a generic prototype-pollution primitive but materially overstates real-world exposure: the description itself constrains exploitation to applications that (a) wire missingKeyHandler (or an equivalent saveMissing route) to untrusted input AND (b) leave keySeparator at its default. Apps without that exact configuration are not affected through this attack path. There is no EPSS score, KEV listing, or SSVC decision provided in the input, and no public exploit identified at time of analysis - only the vendor advisory and fix commit are public, so this should be treated as a credible, patch-now issue for any service that proxies user input into i18next.t(..., { saveMissing: true }), but not as evidence of mass active exploitation. Confidentiality is rated N because the primitive writes to prototypes rather than directly reading data, but secondary C impact is plausible if polluted properties bypass auth checks downstream - defenders should not assume C:N translates to 'no data risk'.

A public-facing Node.js web app uses i18next with i18next-http-middleware and exposes the missingKeyHandler endpoint so that browsers can report untranslated strings. The attacker sends an HTTP request that registers a missing key of '__proto__.isAdmin' with value true; writeFile() splits the key on '.', setPath() walks into Object.prototype, and every subsequent object in the process now reports isAdmin === true, letting the attacker bypass a property-based authorization check or crash request handlers that branch on prototype state. No public PoC was supplied in the input but the security test suite added in the fix commit demonstrates the primitive end-to-end.