Executive brief
i18next-fs-backend is a software component used by Node.js and Deno applications to load website translations from a server's disk. A security flaw allows attackers to manipulate language settings to access or overwrite sensitive files on the server, such as configuration files or credentials. This could lead to the theft of private data or the corruption of system files, potentially causing a service outage.
Technical details
A path traversal vulnerability (CWE-22) exists in i18next-fs-backend due to unvalidated interpolation of 'lng' and 'ns' options into filesystem path templates. An attacker can provide crafted input containing path traversal sequences (e.g., '../'), control characters, or prototype keys via HTTP headers, query strings, or cookies. This allows for arbitrary file read of any file accessible by the Node.js process, and potentially arbitrary file overwrite if the 'saveMissing' feature is enabled. The issue is resolved in version 2.6.4 by introducing a sanitization layer that validates substituted values against a denylist of dangerous characters and length limits.
Affected products
- i18next i18next-fs-backend < 2.6.4
Timeline
- 2026-04-18: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD
- 2026-05-08: patched: Fix released in version 2.6.4