CVE-2026-55451: Npm/gettext-converter vulnerability
Impact
js2i18next() is vulnerable to prototype pollution. When converting translations, it splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object. A key whose segment is proto (e.g. proto##gcPolluted) causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime.
Any application that converts translation data (PO / i18next JS objects) originating from an untrusted or user-controlled source is affected. Prototype pollution can lead to denial of service and, depending on the surrounding application, may enable further attacks.
Patches
Fixed in gettext-converter@1.3.3. Key segments equal to proto, constructor, or prototype are now rejected before being used as dynamic object keys.
Workarounds
Upgrade to 1.3.3. If upgrading is not immediately possible, sanitize/validate translation keys before passing them to js2i18next() and reject any key whose ##-separated segments include proto, constructor, or prototype.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/gettext-converterto a version that resolves this vulnerability.Fixed in 1.3.3 - Upgrade
Upgrade
gettext-converterto a version that resolves this vulnerability.Fixed in 1.3.3 - Configuration
If you cannot upgrade to 1.3.3, sanitize/validate translation keys before passing them to js2i18next(): split nested keys on the key separator (default `##`) and reject any key whose segments include `__proto__`, `constructor`, or `prototype`.
gettext-converter (js2i18next input handling) translation key validation (nested key segments split on key separator default `##`) = Reject keys where any `##`-separated segment is `__proto__`, `constructor`, or `prototype` (including segment equal to those values)
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using gettext-converter to pass PO files or i18next JavaScript translation objects from an untrusted or user-controlled source into js2i18next() are affected. The default key separator is ##, so malicious nested key segments can be interpreted without a custom separator configuration.
What input is required to exploit the vulnerability?
An attacker needs control over a translation key processed by js2i18next(). A key such as __proto__##gcPolluted causes a write to Object.prototype; segments named constructor or prototype are also unsafe.
What can be done before upgrading?
Validate or sanitize translation keys before they reach js2i18next(). Reject any key with a ##-separated segment equal to __proto__, constructor, or prototype.
How can I determine whether the installed package is fixed?
The issue is fixed in gettext-converter version 1.3.3. That release rejects __proto__, constructor, and prototype segments before using them as dynamic object keys.