CVE-2026-115730: i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

Published Oct 23, 2026

Updated

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Affected Software

1 affected component

npm/i18next-http-backend=4.0.2

Event History

Oct 23, 2026

CVE Published

via MITRE·12:55 PM

Data Sourced

via MITRE·12:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What conditions are required for exploitation?

An attacker must be able to control the namespace (ns) value used by i18next-http-backend. Exploitation also requires a loadPath or addPath template in which that value is interpolated, allowing a namespace beginning with a slash to create a protocol-relative URL.

What is the practical impact if exploitation succeeds?

Translation requests can be redirected to attacker-hosted resources. This can enable injection of attacker-controlled UI content and potentially cross-site scripting.

Are applications using the package affected by default?

The available information identifies i18next-http-backend 4.0.2 as affected, but does not establish that every default configuration is exploitable. Exposure depends on whether untrusted parties can influence the namespace value and whether it is used in loadPath or addPath URL templates.

What can be done if an update cannot be applied immediately?

Prevent untrusted input from controlling namespace values, especially values beginning with a slash. Ensure namespace values used in loadPath or addPath interpolation are restricted to expected, validated names.

CVE-2026-115730: i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact if exploitation succeeds?

Are applications using the package affected by default?

What can be done if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact if exploitation succeeds?

Are applications using the package affected by default?

What can be done if an update cannot be applied immediately?