Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...

MAL-2026-14052 Malicious code in require-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b5f50249e747ea23b84fdc6baa2202e9d786a872fd7d9a545017dc6fc5ad788 The package's preinstall.js reads a hex-encoded command string from preinstall.json, decodes it with Buffer.fromhex, 'hex', and passes the result to...

Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

MAL-2026-12768 Malicious code in devplatform-spa-plugin-i18next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 88e8b3586c4dee4e4e812d6dc1771ec4bc99bc01058c0ae3d2e8c0cdaa8072c8 index.js unconditionally requires./loader on load. loader.js reassembles Cloudflare workers.dev hostnames oob-worker.cf103-070.workers.dev,...

Security Bulletin: Multiple Vulnerabilities in IBM Cloud Pak System

Summary Multiple vulnerabilities were addressed in IBM Cloud Pak System version 2.3.5.1. Vulnerability Details CVEID:CVE-2026-48714 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, th...

Security Bulletin: Code injection, cross-site scripting, and other vulnerabilities might affect IBM Storage Defender - Resiliency Service

Summary IBM Storage Defender - Resiliency Service is vulnerable to code injection, cross-site scripting, and others. The vulnerabilities have been addressed. Vulnerability Details CVEID:CVE-2025-46295 DESCRIPTION: Apache Commons Text versions prior to 1.10.0 included interpolation features that...

Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities

Summary IBM Guardium Data Security Center has addressed these vulnerabilities with an update. Vulnerability Details CVEID:CVE-2026-41683 DESCRIPTION: i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3,...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by vulnerabilities in i18next, follow-redirects, & brace-expansion

Summary SPSS Collaboration and Deployment Services is affected by vulnerabilities in i18next, follow-redirects, & brace-expansion. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-40895 DESCRIPTION: follow-redirects is an open source, drop-in replacement fo...

GHSA-2933-Q333-QG83 i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...

EUVD-2026-37005

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string...

i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

Impact i18next-fs-backend ≤ 2.6.5, when used to persist missing translation keys e.g. via i18next-http-middleware's missingKeyHandler exposed to untrusted input, is vulnerable to prototype pollution via crafted missing-key strings. Backend.writeFile splits each queued missing-key string on the...

NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string

NPM: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string vulnerability discovered by ? in WordPress Npm i18next-fs-backend versions 2.6.6...

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...

NPM: i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

NPM: i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names vulnerability discovered by ? in WordPress Npm i18next-http-middleware versions 3.9.7...

EUVD-2026-37006

i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names...

GHSA-F49M-VF83-692W i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names

Impact i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not reject dotted variants such as "proto.polluted". Downstream backends that split the missing-key string on a...

Prototype Pollution

Overview i18next-http-middleware is an i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Affected versions of this package are vulnerable to Prototype Pollution via the missingKeyHandler method. An attacker can cause...

Prototype Pollution

Overview i18next-fs-backend is an i18next-fs-backend is a backend layer for i18next using in Node.js and for Deno to load translations from the filesystem. Affected versions of this package are vulnerable to Prototype Pollution via the getLastOfPath method. An attacker can modify global object...

CVE-2026-48714

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not...

CVE-2026-48714 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys proto, constructor, and prototype added in 3.9.3, see GHSA-5fgg-jcpf-8jjw, but did not...