Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-41690 · Microsoft / collected KEV context

EUVD-2026-28792

GHSA-5fgg-jcpf-8jjw

cve-program · CVE-2026-41690

• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw

euvd · EUVD-2026-28792

• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw

nvd · CVE-2026-41690

• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw

osv · GHSA-5fgg-jcpf-8jjw

• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw
• https://nvd.nist.gov/vuln/detail/CVE-2026-41690
• https://github.com/i18next/i18next-http-middleware
• https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted

No related operational record is retained in the current change model.