Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

🗓️ 23 Oct 2026 15:31:30Reported by GitHub Advisory DatabaseType

github🔗 github.com👁 3 Views

Incomplete fix in i18next-http-backend interpolateUrl() allows UI content injection.

Reporter	Title	Published	Views	Family All 22
Circl	CVE-2026-115730	23 Oct 202614:36	–	circl
CVE	CVE-2026-115730	23 Oct 202612:55	–	cve
Cvelist	CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl	23 Oct 202612:55	–	cvelist
Debian CVE	CVE-2026-115730	23 Oct 202612:55	–	debiancve
EUVD	EUVD-2026-108941	28 Oct 202621:07	–	euvd
Github Security Blog	i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)	28 Oct 202621:07	–	github
Mend	CVE-2026-115730	23 Oct 202612:55	–	mend
NVD	CVE-2026-115730	23 Oct 202613:17	–	nvd
osv_ghsa	GHSA-9JHJ-WVMW-CFX5 i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)	28 Oct 202621:07	–	osv_ghsa
osv_ghsa	GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF	6 Oct 202615:33	–	osv_ghsa

Vulners

Node

i18next i18next-http-backendRange≤4.0.2npm

Source	Link
github	www.github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
github	www.github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-115730
github	www.github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7
vulncheck	www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl
github	www.github.com/advisories/GHSA-w47m-j727-m843

28 Oct 2026 21:07Current

5.4Medium risk

Vulners AI Score5.4

CVSS 42.3

CVSS 3.13.1

EPSS0.00217

i18next-http-backend interpolateUrl()UI content injection cross-site scripting protocol-relative URL