Executive brief
i18next-http-middleware is a middleware library used in Node.js web applications (Express, Fastify) to handle internationalization (i18n) and localization. A vulnerability in versions prior to 3.9.3 allows unauthenticated attackers to pollute the JavaScript Object prototype or perform path traversal attacks via user-controlled language and namespace parameters, potentially breaking authorization checks, causing denial of service, or executing arbitrary code depending on application logic.
Technical details
The vulnerability is a prototype pollution and path traversal flaw in two unauthenticated HTTP handler entry points. The getResourcesHandler reads user-controlled `lng` (language) and `ns` (namespace) parameters from query strings or route parameters and passes them unvalidated to `utils.setPath()`, which does not guard against `__proto__`, `constructor`, or `prototype` keys, enabling writes to Object.prototype. Similarly, the missingKeyHandler iterates request body properties using for...in, which traverses inherited prototype properties, allowing POST bodies containing `__proto__` to be forwarded into saveMissing callbacks. Additionally, depending on the configured backend (e.g., i18next-fs-backend or i18next-http-backend), unvalidated language/namespace values can enable filesystem path traversal (via sequences like `../../etc/passwd`) or Server-Side Request Forgery. A single unauthenticated request like `GET /locales/resources.json?lng=__proto__&ns=isAdmin` pollutes Object.prototype affecting all subsequently created objects in the process. Fixed in version 3.9.3 with blocklisting of dangerous keys, adoption of Object.keys() iteration, and a new `utils.isSafeIdentifier` validation helper that filters input before backend use.
Affected products
- i18next i18next-http-middleware < 3.9.3
Timeline
- 2026-04-22: disclosed
- 2026-04-22: patched: Fixed in version 3.9.3