CVE-2026-63402

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. An application must explicitly pass attacker-controlled resource...

CVE-2026-63402

The JavaScript internationalization framework i18next is vulnerable to shared built-in corruption in versions prior to 26.3.4 due to a flaw in the deepExtend function within src/utils.js. The root cause is the use of the in operator, which allows recursion into inherited built-ins accessed via Ob...

CVE-2026-63402: i18next: i18next is an internationalization framework for JavaScript

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, deepExtend in src/utils.js checks property existence with the in operator and recurses into inherited built-ins reached through Object.prototype. An application must explicitly pass attacker-controlled resource...