i18next CVE-2026-63402

Exploitation requires the application itself to call addResourceBundle(lng, ns, data, deep, overwrite) with BOTH deep:true AND overwrite:true while passing attacker-controlled resource data; the attacker-supplied source object must contain a key matching an inherited built-in (e.g. hasOwnProperty, toString, valueOf) whose nested value overwrites a property of that shared built-in function (e.g. setting Object.prototype.hasOwnProperty.call non-callable). Strong limiting factors: this is explicitly a non-default configuration - the default addResourceBundle path (no deep merge, or overwrite falsy) is unaffected, and the advisory states no standard i18next backend or integration uses the vulnerable configuration, so exposure is confined to custom application code that deep-merges untrusted translation content. Fixed in 26.3.4, which checks existence with Object.prototype.hasOwnProperty.call instead of the in operator; per the advisory, upgrading is the remediation.

Signals point to a genuine but conditional, lower-tier risk. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H, base 5.9 Medium) encodes the core story: network-reachable but high attack complexity (AC:H) because exploitation is gated behind a specific non-default merge configuration, with impact concentrated in availability (A:H, process-wide unrecoverable DoS) plus limited integrity (I:L, a shared built-in set to an attacker value) and no confidentiality impact (C:N). The vuln.today decision label is 'this_month' rather than act_now/emergency, consistent with a flaw that is serious where present but not broadly exploitable. This is NOT a confirmed-exploited emergency: there is no CISA KEV listing and no EPSS score in the supplied data, so widespread exploitation probability cannot be quantified from the input. A working proof-of-concept is published inside the GitHub Security Advisory (GHSA-6jcc-5g8w-32mx), which raises reproducibility but does not equal active exploitation - POC availability and in-the-wild use are distinct signals. The key tension is between the network attack vector and the real-world precondition: AV:N suggests remote reach, but the advisory is explicit that the flaw only triggers when application code deliberately passes attacker-controlled data to addResourceBundle with both deep:true and overwrite:true, and that no standard i18next backend or integration does this. Net assessment: treat as a targeted/conditional issue to remediate on a normal patch cadence (this month), not a high-urgency widespread threat.

An application exposes a code path that merges externally-supplied translation content into i18next by calling addResourceBundle with deep:true and overwrite:true. An attacker submits a crafted resource bundle such as { hasOwnProperty: { call: 'corrupted' } }, causing deepExtend to recurse into the shared Object.prototype.hasOwnProperty function and overwrite its .call with a non-callable value, so every subsequent hasOwnProperty.call across the process throws TypeError and the service becomes unusable. A working PoC demonstrating exactly this is published in the GHSA advisory; the AC:H rating reflects that the vulnerable deep+overwrite merge of untrusted data is a non-default precondition rather than a difficult trigger once that path exists.