GHSA-3cmx-xjww-583xPublished
i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118258 · Microsoft / collected KEV context
cve-program · CVE-2026-118258
- https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x
- https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510
- https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4
euvd · EUVD-2026-112360
- https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x
- https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510
- https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4
nvd · CVE-2026-118258
- https://github.com/i18next/i18next-http-backend/commit/b0eef9efd425055c554787cef7f878de33bbf510
- https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.4
- https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-3cmx-xjww-583x
osv · GHSA-3cmx-xjww-583x
Related operational evidence
Explicit CVE identifiers- i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without r… · Advisory content revised · 30 Oct 2026
- i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without r… · Advisory content revised · 30 Oct 2026
- i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string · Newly collected advisory · 28 Oct 2026
- i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string · Newly collected advisory · 28 Oct 2026