CVE-2026-41691

Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default, i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL.

Affected call sites:

• _readAny, lib/index.js:64: interpolate(resolvedLoadPath, { lng: languages.join('+'), ns: namespaces.join('+') })
• create, lib/index.js:123 (pre-patch): interpolate(addPath, { lng, ns: namespace })

The helper interpolate (lib/utils.js) previously returned the raw value with no encoding. In contrast, addQueryString already correctly uses encodeURIComponent for each query-string param, only the URL-path substitution was unprotected.

Also fixed in 3.0.5

• Per-instance omitFetchOptions. A module-level boolean in lib/request.js was flipped to true the first time any backend instance hit a "not implemented" fetch error. Once flipped, all subsequent requests from all backend instances in the same module silently stripped every user-configured fetch option, including security-relevant credentials, mode, and cache. One misbehaving instance (for example during SSR hydration or in React Native) permanently removed these protections process-wide. 3.0.5 scopes the flag to the backend's options object (options._omitFetchOptions) so one instance's fallback cannot pollute siblings.
• Log forging via control characters in lng/ns. Error callbacks embedded the raw lng/ns/URL in the message string. Crafted CR/LF values could inject fake log lines into file-backed log aggregators (CWE-117). 3.0.5 strips C0/C1 control chars before concatenation.
• Basic-auth credentials leaked into error callbacks. If loadPath contained a user:password@host authority, the full URL (including the credentials) ended up in the error message strings returned to the caller. 3.0.5 redacts user:password@ before logging.
• Prototype-pollution amplification via for...in. addQueryString and the XHR customHeaders loop used for...in which walks the prototype chain. Polluted Object.prototype entries could leak into URL query parameters and request headers. 3.0.5 uses Object.keys and an explicit prototype-key guard.

Affected versions

All versions of i18next-http-backend prior to 3.0.5.

Workarounds

No workaround short of upgrading. If you cannot upgrade immediately, sanitise lng / ns yourself before they reach i18next (strip .., /, \, ?, #, %, whitespace, and control characters; cap the length).

Credits

Discovered via an internal security audit of the i18next ecosystem.

An attacker who can influence the resolved lng or ns value can alter the URL in several ways:

• Path traversal, lng = '../../config' turns /locales/{{lng}}/{{ns}}.json into /locales/../../config/translation.json. On a misconfigured web server, this can cause the request to target a different resource than intended; in SSR pipelines that use file:// or similar schemes for loadPath, it can read arbitrary files from the host filesystem.
• Query-string injection, lng = 'en?admin=true' turns /locales/{{lng}}/{{ns}}.json into /locales/en?admin=true/translation.json. Some server frameworks parse the query portion with higher priority than the path and branch on attacker-controlled flags.
• Fragment truncation, lng = 'en#anything' silently discards the rest of the path in browser fetches (client cannot see the final URL).
• URL-encoded bypasses, lng = 'en%2F..', after server-side URL decoding, resolves to en/.., the attacker bypasses the absence of a literal / in their input.

The practical worst case is SSRF when loadPath is an internal or file-scheme URL, and path-based authorisation bypass against servers that segment access by URL prefix.

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2026-41691 has a CVSS score of 6.5 (Medium). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (3.0.5); upgrading removes the vulnerable code path.

Kodem intelligence

Fixed in 3.0.5. Summary of the hardening:

1. New utils.interpolateUrl (used by _readAny and create) returns null if any substitution fails the URL-segment safety check (blocks .., /, \, ?, #, %, @, whitespace, control chars, prototype keys, and values > 128 chars). Multi-language joins (en+de) are validated per-segment. The call sites now refuse to issue a request when the check fails and call back with a clear error.
2. omitFetchOptions is stored per-instance on options._omitFetchOptions.
3. Error-callback messages sanitise strings and redact URL credentials.
4. for...in over untrusted objects replaced with Object.keys + prototype-key guard.

1. What is CVE-2026-41691? CVE-2026-41691 is a medium-severity path traversal vulnerability in i18next-http-backend (npm), affecting versions < 3.0.5. It is fixed in 3.0.5. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2026-41691? CVE-2026-41691 has a CVSS score of 6.5 (Medium). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which versions of i18next-http-backend are affected by CVE-2026-41691? i18next-http-backend (npm) versions < 3.0.5 is affected.
4. Is there a fix for CVE-2026-41691? Yes. CVE-2026-41691 is fixed in 3.0.5. Upgrade to this version or later.
5. Is CVE-2026-41691 exploitable, and should I be worried? Whether CVE-2026-41691 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2026-41691 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2026-41691? Upgrade i18next-http-backend to 3.0.5 or later.