CVE-2026-118258: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
i18next-http-backendto a version that resolves this vulnerability.Fixed in 4.0.4
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using i18next-http-backend before 4.0.4 are exposed only when a loadPath or addPath template places the lng or ns placeholder in the query string and an attacker can control the corresponding language or namespace value.
What can an attacker do if they can exploit this?
They can inject query separators such as &, =, or ; into the language or namespace value to add or override parameters on translation-resource requests. Depending on the application's network position and credentials, this could expose other namespaces or tenants or alter backend behavior.
Does an attacker need authentication or user interaction?
No authentication or user interaction is required according to the supplied CVSS vector. Exploitation has high attack complexity and still depends on attacker control of lng or ns in an affected query-string template.
How can I determine whether my configuration is affected?
Check whether i18next-http-backend is earlier than 4.0.4, then inspect loadPath and addPath templates for {{lng}} or {{ns}} placed in a query string. Also determine whether untrusted input can influence the language or namespace used for translation requests.
What is the remediation?
Upgrade i18next-http-backend to version 4.0.4. If an immediate upgrade is not possible, avoid placing attacker-controllable lng or ns values in query-string portions of loadPath or addPath templates.