# CVE-2026-41693: i18next-fs-backend path traversal in locale loading

Source: https://junglewise.ai/threats/cve-2026-41693-i18next-fs-backend-path-traversal-in-lng-and-ns-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-08. Updated: 2026-05-14  
License: CC BY 4.0 with a link back

CVE-2026-41693 · Severity: high · CVSS 8.2 · Published 2026-05-08

i18next-fs-backend is a software component used by Node.js and Deno applications to load website translations from a server's disk. A security flaw allows attackers to manipulate language settings to access or overwrite sensitive files on the server, such as configuration files or credentials. This could lead to the theft of private data or the corruption of system files, potentially causing a service outage.

Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-41693 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-41693 being exploited in the wild.

**How severe is CVE-2026-41693?** High severity, with a CVSS score of 8.2, published 8 May 2026.

**Which products and versions are affected?** i18next-fs-backend (npm) < 2.6.4, SEMVER:introduced=0,fixed=2.6.4.

**Is there a fix for CVE-2026-41693?** Yes. i18next-fs-backend (npm): upgrade to 2.6.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-41693 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-41693?** Check whether you run i18next-fs-backend (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- i18next-fs-backend (npm): upgrade to 2.6.4 or later

  ```sh
  npm install i18next-fs-backend@2.6.4
  ```


## Technical details

A path traversal vulnerability (CWE-22) exists in i18next-fs-backend due to unvalidated interpolation of 'lng' and 'ns' options into filesystem path templates. An attacker can provide crafted input containing path traversal sequences (e.g., '../'), control characters, or prototype keys via HTTP headers, query strings, or cookies. This allows for arbitrary file read of any file accessible by the Node.js process, and potentially arbitrary file overwrite if the 'saveMissing' feature is enabled. The issue is resolved in version 2.6.4 by introducing a sanitization layer that validates substituted values against a denylist of dangerous characters and length limits.

## Affected products

- i18next i18next-fs-backend < 2.6.4

## Identifiers

- CVE-2026-41693
- GHSA-8847-338w-5hcj

## Timeline

- 2026-04-18: advisory: GitHub Security Advisory published
- 2026-05-08: disclosed: CVE published to NVD
- 2026-05-08: patched: Fix released in version 2.6.4

## References

- [https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-8847-338w-5hcj](https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-8847-338w-5hcj)

## Related threats

- [i18next-fs-backend prototype pollution in missing-key persistence](https://junglewise.ai/threats/cve-2026-48713-i18next-fs-backend-prototype-pollution-in-missing-key-persistence)