CVE-2026-42353: i18next-http-middleware Path Traversal and SSRF in getResourcesHandler

CVE-2026-42353 · Severity: high · CVSS 8.2 · Published 2026-05-08

i18next-http-middleware is a tool used by web applications to handle language translations. A security flaw in versions prior to 3.9.3 allows attackers to manipulate language and namespace parameters to access sensitive files on the server or make unauthorized requests to internal systems. This could lead to the theft of configuration files, credentials, or private data, potentially compromising the entire server environment.

Technologies: i18next-http-middleware (npm). Vendors: npm.

Quick answers

Is CVE-2026-42353 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-42353 being exploited in the wild.
How severe is CVE-2026-42353?
High severity, with a CVSS score of 8.2, published 8 May 2026.
Which products and versions are affected?
i18next-http-middleware (npm) < 3.9.3, SEMVER:introduced=0,fixed=3.9.3.
Is there a fix for CVE-2026-42353?
Yes. i18next-http-middleware (npm): upgrade to 3.9.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-42353 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-42353?
Check whether you run i18next-http-middleware (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • i18next-http-middleware (npm): upgrade to 3.9.3 or later
    npm install i18next-http-middleware@3.9.3

Technical details

The vulnerability exists in the `getResourcesHandler` function of i18next-http-middleware. User-controlled `lng` (language) and `ns` (namespace) values are passed directly to `i18next.services.backendConnector.load()` without sanitization. If the middleware is used with `i18next-fs-backend`, an attacker can use path traversal sequences (e.g., `../../etc/passwd`) to read arbitrary files. If used with `i18next-http-backend`, an attacker can perform SSRF by reshaping the outgoing URL to target internal services. The issue is fixed in version 3.9.3 by implementing a safety check (`isSafeIdentifier`) that rejects relative path sequences, path separators, and control characters.

Affected products

  • i18next i18next-http-middleware < 3.9.3

Identifiers

  • CVE-2026-42353
  • GHSA-jfgf-83c5-2c4m

Timeline

  • 2026-04-22: advisory: GitHub Security Advisory published
  • 2026-05-08: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.