EUVD-2026-28792CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Lifecycle Timeline
4Blast Radius
ecosystem impact- 1 npm packages depend on i18next-http-middleware (1 direct, 0 indirect)
Ecosystem-wide dependent count for version 3.9.3.
DescriptionNVD
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
AnalysisAI
Object.prototype pollution in i18next-http-middleware prior to 3.9.3 allows remote unauthenticated attackers to inject arbitrary properties into all JavaScript objects via crafted HTTP requests, bypassing authorization checks, causing type-confusion denial of service, or enabling remote code execution when chained with vulnerable downstream code. The vulnerability is actively exploitable through two unprotected API endpoints (getResourcesHandler and missingKeyHandler) that accept user-controlled language and namespace parameters without validation. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Identify all applications using i18next-http-middleware and document current versions via dependency manifests (package.json, package-lock.json, or yarn.lock). Within 7 days: Implement network-level access restrictions to getResourcesHandler and missingKeyHandler endpoints; restrict access to trusted internal systems only. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today