i18next-http-backend EUVD-2026-93433

Exploitation requires that the application configure a custom loadPath or addPath template that begins DIRECTLY with the {{lng}} or {{ns}} placeholder (e.g. '{{lng}}/{{ns}}.json'), with no leading '/' path and no origin prefix - only then does the placeholder occupy the URL's structural beginning. The attacker must also control the language or namespace value passed to i18next (e.g. via user-selectable locale), and inject a colon to form an absolute URL, or in browser contexts a leading double-slash in the namespace to form a protocol-relative URL. LIMITING FACTORS: the default '/locales/{{lng}}/{{ns}}.json' template and ANY template with a leading path segment or origin are NOT exploitable, because a colon inside a path segment has no structural meaning - this makes the vulnerable configuration uncommon and is why CVSS attack complexity is High. Versions 4.0.2 and later reject these values outright.

All signals point to a low-priority issue despite the network attack vector. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N, base 3.7) correctly reflects that exploitation requires no authentication but carries HIGH attack complexity and yields only LOW confidentiality impact with no integrity or availability effect. The AC:H rating is well-justified by the vulnerability's dependency on a specific, non-default configuration: the application must use a custom loadPath/addPath template that begins directly with the {{lng}} or {{ns}} placeholder. No EPSS score was provided in the input, so exploitation probability cannot be quantified. There is no CISA KEV listing and no public exploit code was identified - the only source-code artifact is the vendor's remediation commit, not a proof-of-concept. The signals are internally consistent rather than conflicting: a genuinely low-impact (information-disclosure-grade) SSRF/URL-injection flaw gated behind an uncommon configuration. This is a legitimate defense-in-depth fix to apply during normal patch cycles, not an emergency.

A Node.js or browser application configures i18next-http-backend with a custom loadPath such as '{{lng}}/{{ns}}.json' (no leading slash or origin) and derives the language or namespace from user-controllable input. An attacker supplies a value like 'http:127.0.0.1:8080', which is interpolated into what becomes an absolute URL, causing the backend to issue a request to an attacker-chosen origin (SSRF) rather than the intended server. No public exploit code was identified at time of analysis; the only available code artifact is the vendor fix commit.