CVE-2026-41683: i18next-http-middleware CRLF injection in Content-Language header

CVE-2026-41683 · Severity: high · CVSS 8.6 · Published 2026-05-08

i18next-http-middleware is a tool used by web developers to handle language detection in Node.js and Deno applications. A security flaw allows attackers to inject malicious characters into the website's response headers. Depending on the server configuration, this can lead to the site crashing (denial of service) or allow attackers to perform advanced attacks like session hijacking and redirecting users to malicious websites.

Technologies: i18next-http-middleware (npm). Vendors: npm.

Quick answers

Is CVE-2026-41683 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-41683 being exploited in the wild.
How severe is CVE-2026-41683?
High severity, with a CVSS score of 8.6, published 8 May 2026.
Which products and versions are affected?
i18next-http-middleware (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3.
Is there a fix for CVE-2026-41683?
Yes. i18next-http-middleware (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41683 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-41683?
Check whether you run i18next-http-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • i18next-http-middleware (npm): upgrade to 3.9.3 or later
    npm install i18next-http-middleware@3.9.3

Technical details

i18next-http-middleware prior to version 3.9.3 is vulnerable to HTTP response splitting and denial of service. The middleware used an HTML-entity encoder (utils.escape) that failed to strip carriage return (CR) and line feed (LF) characters from user-provided language parameters. When paired with older versions of i18next (< 19.5.0), these raw CRLF sequences are passed directly to res.setHeader(). In Node.js versions < 14.6.0, this allows for HTTP response splitting, enabling header injection, cache poisoning, and reflected XSS. In Node.js versions >= 14.6.0, the same exploit triggers an unhandled ERR_INVALID_CHAR exception, leading to a denial of service. Version 3.9.3 fixes this by introducing a new sanitization function and tightening XSS regex filters.

Affected products

  • i18next i18next-http-middleware < 3.9.3

Identifiers

  • CVE-2026-41683
  • GHSA-c3h8-g69v-pjrg

Timeline

  • 2026-04-18: advisory: GitHub Security Advisory published
  • 2026-05-08: disclosed: CVE published to NVD
  • 2026-05-08: patched: Fix released in version 3.9.3

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.