Is CVE-2026-63402 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-63402 being exploited in the wild.

How severe is CVE-2026-63402?

Medium severity, with a CVSS score of 5.9, published 30 October 2026.

How is CVE-2026-63402 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-63402?

Check whether you run I18next at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-63402: i18next deepExtend prototype pollution in addResourceBundle

CVE-2026-63402 · Severity: medium · CVSS 5.9 · Published 2026-10-30

i18next is a JavaScript translation library used by web applications to manage multi-language content. An application that passes untrusted translation data to the library's addResourceBundle method with both deep merging and overwrite enabled can have shared built-in functions corrupted process-wide, causing the application to crash and become unrecoverable. This affects only applications that explicitly configure the vulnerable settings; standard usage is unaffected.

Vendors: I18next.

Quick answers

Is CVE-2026-63402 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-63402 being exploited in the wild.
How severe is CVE-2026-63402?: Medium severity, with a CVSS score of 5.9, published 30 October 2026.
Which products and versions are affected?: I18next prior to 26.3.4.
Is there a fix for CVE-2026-63402?: Yes: fixed in 26.3.4. Until then: Do not pass attacker-controlled data to addResourceBundle with both deep: true and overwrite: true enabled. Use the default configuration (without deep merging or with overwrite set to false), which is not affected by this vulnerability. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63402 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-63402?: Check whether you run I18next at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.3.4

Do not pass attacker-controlled data to addResourceBundle with both deep: true and overwrite: true enabled. Use the default configuration (without deep merging or with overwrite set to false), which is not affected by this vulnerability.

Technical details

The deepExtend function in src/utils.js checks property existence using the `in` operator, which walks the prototype chain. An attacker-controlled source key matching an inherited built-in (e.g., hasOwnProperty, toString) causes recursion into the shared object on Object.prototype. With overwrite: true, a nested value can overwrite a property of the shared built-in—for example setting Object.prototype.hasOwnProperty.call to a non-callable value—corrupting it process-wide. The existing __proto__/constructor guard does not prevent this because the corruption target is an inherited built-in function, not the prototype object itself.

Affected products

i18next i18next prior to 26.3.4

Timeline

2026-10-30: disclosed
2026-10-30: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.