# CVE-2026-41690: i18next-http-middleware prototype pollution in getResourcesHandler and missingKeyHandler

Source: https://junglewise.ai/threats/cve-2026-41690-i18next-http-middleware-prototype-pollution-and-path-traversal  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-41690 · Severity: high · CVSS 8.6 · Published 2026-05-08

i18next-http-middleware is a middleware library used in Node.js web applications (Express, Fastify) to handle internationalization (i18n) and localization. A vulnerability in versions prior to 3.9.3 allows unauthenticated attackers to pollute the JavaScript Object prototype or perform path traversal attacks via user-controlled language and namespace parameters, potentially breaking authorization checks, causing denial of service, or executing arbitrary code depending on application logic.

Technologies: [i18next-http-middleware (npm)](https://junglewise.ai/threats/technologies/i18next-http-middleware). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41690 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41690 being exploited in the wild.

**How severe is CVE-2026-41690?** High severity, with a CVSS score of 8.6, published 8 May 2026.

**Which products and versions are affected?** i18next-http-middleware (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3.

**Is there a fix for CVE-2026-41690?** Yes. i18next-http-middleware (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41690 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41690?** Check whether you run i18next-http-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- i18next-http-middleware (npm): upgrade to 3.9.3 or later

  ```sh
  npm install i18next-http-middleware@3.9.3
  ```


## Technical details

The vulnerability is a prototype pollution and path traversal flaw in two unauthenticated HTTP handler entry points. The getResourcesHandler reads user-controlled `lng` (language) and `ns` (namespace) parameters from query strings or route parameters and passes them unvalidated to `utils.setPath()`, which does not guard against `__proto__`, `constructor`, or `prototype` keys, enabling writes to Object.prototype. Similarly, the missingKeyHandler iterates request body properties using for...in, which traverses inherited prototype properties, allowing POST bodies containing `__proto__` to be forwarded into saveMissing callbacks. Additionally, depending on the configured backend (e.g., i18next-fs-backend or i18next-http-backend), unvalidated language/namespace values can enable filesystem path traversal (via sequences like `../../etc/passwd`) or Server-Side Request Forgery. A single unauthenticated request like `GET /locales/resources.json?lng=__proto__&ns=isAdmin` pollutes Object.prototype affecting all subsequently created objects in the process. Fixed in version 3.9.3 with blocklisting of dangerous keys, adoption of Object.keys() iteration, and a new `utils.isSafeIdentifier` validation helper that filters input before backend use.

## Affected products

- i18next i18next-http-middleware < 3.9.3

## Identifiers

- CVE-2026-41690
- GHSA-5fgg-jcpf-8jjw

## Timeline

- 2026-04-22: disclosed
- 2026-04-22: patched: Fixed in version 3.9.3

## References

- [https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw](https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw)
- [https://github.com/i18next/i18next-http-middleware](https://github.com/i18next/i18next-http-middleware)
- [https://www.i18next.com/how-to/faq](https://www.i18next.com/how-to/faq)

## Related threats

- [i18next-http-middleware Prototype Pollution in missingKeyHandler](https://junglewise.ai/threats/cve-2026-48714-i18next-http-middleware-prototype-pollution-in-missingkeyhandler)
- [i18next-http-middleware Path Traversal and SSRF in getResourcesHandler](https://junglewise.ai/threats/cve-2026-42353-i18next-http-middleware-path-traversal-and-ssrf-in)
- [i18next-http-middleware CRLF injection in Content-Language header](https://junglewise.ai/threats/cve-2026-41683-i18next-http-middleware-http-response-splitting-and-dos-via)