Quick answers
- Is CVE-2026-41690 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-41690 being exploited in the wild.
- How severe is CVE-2026-41690?
- High severity, with a CVSS score of 8.6, published 8 May 2026.
- Which products and versions are affected?
- i18next-http-middleware (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3.
- Is there a fix for CVE-2026-41690?
- Yes. i18next-http-middleware (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-41690 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-41690?
- Check whether you run i18next-http-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- i18next-http-middleware (npm): upgrade to 3.9.3 or later
npm install i18next-http-middleware@3.9.3
Technical details
The vulnerability is a prototype pollution and path traversal flaw in two unauthenticated HTTP handler entry points. The getResourcesHandler reads user-controlled `lng` (language) and `ns` (namespace) parameters from query strings or route parameters and passes them unvalidated to `utils.setPath()`, which does not guard against `__proto__`, `constructor`, or `prototype` keys, enabling writes to Object.prototype. Similarly, the missingKeyHandler iterates request body properties using for...in, which traverses inherited prototype properties, allowing POST bodies containing `__proto__` to be forwarded into saveMissing callbacks. Additionally, depending on the configured backend (e.g., i18next-fs-backend or i18next-http-backend), unvalidated language/namespace values can enable filesystem path traversal (via sequences like `../../etc/passwd`) or Server-Side Request Forgery. A single unauthenticated request like `GET /locales/resources.json?lng=__proto__&ns=isAdmin` pollutes Object.prototype affecting all subsequently created objects in the process. Fixed in version 3.9.3 with blocklisting of dangerous keys, adoption of Object.keys() iteration, and a new `utils.isSafeIdentifier` validation helper that filters input before backend use.
Affected products
- i18next i18next-http-middleware < 3.9.3
Identifiers
- CVE-2026-41690
- GHSA-5fgg-jcpf-8jjw
Timeline
- 2026-04-22: disclosed
- 2026-04-22: patched: Fixed in version 3.9.3