{"id":"EUVD-2026-37006","enisaUuid":"d2b140c6-4388-3e88-9bc5-20510cc21409","description":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7.  If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.","datePublished":"Jun 15, 2026, 8:41:49 PM","dateUpdated":"Jun 16, 2026, 2:50:29 PM","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w\nhttps://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49\n","aliases":"CVE-2026-48714\nGHSA-f49m-vf83-692w\n","assigner":"GitHub_M","epss":0.49,"enisaIdProduct":[{"id":"dec674a2-5240-3dee-a8f3-4b31a1e7c8b5","product":{"name":"i18next-http-middleware","vendor":{"name":"i18next"}},"product_version":"\u003c 3.9.7"}],"enisaIdVendor":[{"id":"48735db0-48d9-3d55-a8af-57ddda93b626","vendor":{"name":"i18next"}}],"enisaIdVulnerability":[{"id":"3659a199-5b39-3f3a-9b4d-73dfcfa535a1","vulnerability":{"id":"GHSA-f49m-vf83-692w","description":"i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names","datePublished":"Jun 25, 2026, 5:28:12 PM","dateUpdated":"Jun 25, 2026, 5:28:12 PM","baseScore":0.0,"references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-48714\nhttps://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49\nhttps://github.com/i18next/i18next-http-middleware\n","enisa_id":"EUVD-2026-37006\n","aliases":"CVE-2026-48714\nGHSA-f49m-vf83-692w\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:46 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"8fdae228-7b8e-3be6-862a-6d3f66eb5467","vulnerability":{"id":"CVE-2026-48714","description":"i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7.  If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.","datePublished":"Jun 15, 2026, 8:41:49 PM","dateUpdated":"Jun 16, 2026, 2:50:29 PM","status":"PUBLISHED","baseScore":9.1,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","references":"https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w\nhttps://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49\n","enisa_id":"EUVD-2026-37006\n","assigner":"GitHub_M","epss":0.49,"dataProcessed":"Nov 5, 2026, 7:19:06 AM","vulnerabilityProduct":[{"id":"1815652f-381f-34fe-8126-ee4d4dda04b4","product":{"name":"i18next-http-middleware","vendor":{"name":"i18next"}},"product_version":"\u003c 3.9.7"}],"vulnerabilityVendor":[{"id":"529303f5-862e-366a-9418-31104b75acc7","vendor":{"name":"i18next"}}]}}],"enisaIdAdvisory":[]}