CVE-2026-115730

A flaw was found in i18next-http-backend. A remote attacker who can control namespace values can supply input starting with a slash to construct protocol-relative URLs in path templates. This flaw allows translation requests to be redirected to an attacker-controlled server, leading to cross-site...

CVE-2026-115730

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-115730 i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

EUVD-2026-108941

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

CVE-2026-115730

The i18next-http-backend version 4.0.2 is vulnerable to a Protocol-Relative URL Injection due to an incomplete fix in the interpolateUrl() function. An attacker who can control the namespace value can provide a string starting with a slash to construct a protocol-relative URL within loadPath or a...

PT-2026-121941

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load...

Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities indompurify, axios, and i18next-http-backend

Summary SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities indompurify, axios, and i18next-http-backend. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-105800 DESCRIPTION: i18next-http-backend is a backend layer for i18next...

Linux Distros Unpatched Vulnerability : CVE-2026-105800

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled languag...

CVE-2026-105800

A flaw was found in i18next-http-backend. A remote attacker can supply crafted language or namespace values to applications configured with custom translation path templates that begin directly with placeholders. This manipulation causes the application to generate unintended external web...

NPM: i18next-http-backend incomplete URL validation permits SSRF

NPM: i18next-http-backend incomplete URL validation permits SSRF vulnerability discovered by ? in WordPress Npm i18next-http-backend versions 4.0.2...

i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

Server-side Request Forgery (SSRF)

Overview i18next-http-backend is an i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via insufficient validation in isSafeUrlSegment functions in lib/utils.js,...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: GHSA-XVQ9-WJP8-HWQF...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800 Source advisory: SNYK:JS-I18NEXTHTTPBACKEND-20580644...

@coveo/atomic (>=3.61.2, <=3.61.3), @coveo/atomic-angular (>=3.11.25, <=3.11.26) +13 more potentially affected by CVE-2026-105800 +1 more via i18next-http-backend (>=4.0.0, <=4.0.1)

i18next-http-backend NPM version =4.0.0, =3.61.2, =3.11.25, =3.11.42, =3.11.42, =3.61.2, =3.11.42, =3.61.2, =1.0.0-rc.6, =1.15.0, =1.6.1, =5.0.0, =10.0.0, =3.0.0, =3.0.5 - zhiyu-hands 1.14.0 Source cves: CVE-2026-105800, CVE-2026-115730 Source advisory: OSV:GHSA-XVQ9-WJP8-HWQF...

GHSA-XVQ9-WJP8-HWQF i18next-http-backend incomplete URL validation permits SSRF

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolat...

DEBIAN-CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...

CVE-2026-105800

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with lng or ns can make colon-based input becom...