UBUNTU-CVE-2026-118258: Low severity ubuntu/node-i18next-http-backend vulnerability

Published Oct 29, 2026

Updated

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

Affected Software

4 affected components

ubuntu/node-i18next-http-backend*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade i18next-http-backend to a version that resolves this vulnerability.
Fixed in 4.0.4

Frequently Asked Questions

Which deployments are exposed to this issue?

Deployments using i18next-http-backend before 4.0.4 are exposed when their loadPath or addPath template places the language or namespace value in a query string and an attacker can control that value. The affected backend can be used in Node.js, browsers, or Deno.

What does an attacker need to exploit it?

An attacker must be able to supply a language or namespace value used by the application and the application must interpolate that value into the query string portion of a loadPath or addPath template. Exploitation relies on injecting ampersand, equals, or semicolon query separators to add or override request parameters.

Are applications using default path templates necessarily affected?

The provided information identifies exposure only when a template places lng or ns in the query string. It does not state whether any default template uses those values in a query string.

What can be done if upgrading is not immediately possible?

Avoid placing attacker-controlled language or namespace values in the query-string portion of loadPath or addPath templates. Restrict those values so they cannot contain ampersand, equals, or semicolon characters.

How can I determine whether my application is affected?

Check whether it uses i18next-http-backend earlier than 4.0.4, then inspect loadPath and addPath templates. The issue applies if lng or ns is interpolated into a query string and the corresponding value can be influenced by an attacker.