i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, , %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like...

GHSA-3CMX-XJWW-583X i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, , %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like...

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts lng in the query string vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.4...

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

GHSA-9JHJ-WVMW-CFX5 i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Affected versions Verified on 4.0.2 latest on npm and on commit 07e0288 the GHSA-xvq9-wjp8-hwqf fix. Earlier 3.x/4.x versions that allow / in ns are likely affected too. Not verified on them. Impact Same class as GHSA-xvq9-wjp8-hwqf and GHSA-q89c-q3h5-w34g: when an attacker controls the namespace...

EUVD-2026-108941

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf...

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places ns right after a / bypass of the // check added for GHSA-xvq9-wjp8-hwqf vulnerability discovered by ? in WordPress npm i18next-http-backend versions 4.0.3...

CVE-2026-118258

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

EUVD-2026-112360

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

CVE-2026-118258 i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

CVE-2026-118258

The i18next-http-backend library (a backend layer for i18next used in Node.js, browsers, and Deno) is vulnerable to query-parameter injection in versions prior to 4.0.4 . The root cause is that the interpolateUrl function inserts unencoded language (lng) and namespace (ns) values into loadPath or...

PT-2026-129125

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand &, equals =, or semicolon ; query...

Linux Distros Unpatched Vulnerability : CVE-2026-115730

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting...

UBUNTU-CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references. Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the...

@coveo/atomic (>=3.61.2, <=3.64.0), @coveo/atomic-angular (>=3.11.25, <=3.11.31) +15 more potentially affected by CVE-2026-115730 via i18next-http-backend (>=4.0.0, <=4.0.2)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =1.0.22, =1.0.0, =5.0.0, =10.0.0, =10.0.9 and more Source cves: CVE-2026-115730 Source advisory: SNYK:JS-I18NEXTHTTPBACKEND-21689179...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview org.webjars.npm:i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injectio...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...