{"id":"EUVD-2026-28791","enisaUuid":"48e0412e-3920-37f5-a152-1451069835ad","description":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (\u003c 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader(\u0027Content-Language\u0027, ...) verbatim. This issue has been patched in version 3.9.3.","datePublished":"May 8, 2026, 3:27:05 PM","dateUpdated":"May 8, 2026, 11:29:00 PM","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg\n","aliases":"CVE-2026-41683\nGHSA-c3h8-g69v-pjrg\n","assigner":"GitHub_M","epss":0.33,"enisaIdProduct":[{"id":"619d68fc-2a1d-3d20-a5c4-8a3d30b32692","product":{"name":"i18next-http-middleware","vendor":{"name":"i18next"}},"product_version":"\u003c 3.9.3"}],"enisaIdVendor":[{"id":"ea9e3993-e68f-3f4b-9b5f-3c1e92e710c9","vendor":{"name":"i18next"}}],"enisaIdVulnerability":[{"id":"0d27f0a3-b3a6-32e2-b42a-aea7a89b3477","vulnerability":{"id":"GHSA-c3h8-g69v-pjrg","description":"i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header","datePublished":"Apr 22, 2026, 8:25:49 PM","dateUpdated":"May 13, 2026, 1:29:47 PM","baseScore":0.0,"references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41683\nhttps://github.com/i18next/i18next-http-middleware/commit/65301c194593d46a84623b64e5fde2f51d3550f6\nhttps://github.com/i18next/i18next-http-middleware\n","enisa_id":"EUVD-2026-28791\n","aliases":"GHSA-c3h8-g69v-pjrg\nCVE-2026-41683\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:59:37 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e54eaaab-5f10-3ce2-b7e9-a21b24f86b71","vulnerability":{"id":"CVE-2026-41683","description":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (\u003c 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader(\u0027Content-Language\u0027, ...) verbatim. This issue has been patched in version 3.9.3.","datePublished":"May 8, 2026, 3:27:05 PM","dateUpdated":"May 8, 2026, 11:29:00 PM","status":"PUBLISHED","baseScore":8.6,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L","references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg\n","enisa_id":"EUVD-2026-28791\n","assigner":"GitHub_M","epss":0.33,"dataProcessed":"Nov 3, 2026, 7:17:26 AM","vulnerabilityProduct":[{"id":"d803b291-2857-331d-add4-96155dfd07ce","product":{"name":"i18next-http-middleware","vendor":{"name":"i18next"}},"product_version":"\u003c 3.9.3"}],"vulnerabilityVendor":[{"id":"68ca7172-80e1-3e8e-93c6-b1a9b7926284","vendor":{"name":"i18next"}}]}}],"enisaIdAdvisory":[]}