i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-41691 · Microsoft / collected KEV context

EUVD-2026-28438

GHSA-q89c-q3h5-w34g

cve-program · CVE-2026-41691

• https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
• https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621

euvd · EUVD-2026-28438

• https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
• https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621

nvd · CVE-2026-41691

• https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621
• https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g

osv · GHSA-q89c-q3h5-w34g

• https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
• https://nvd.nist.gov/vuln/detail/CVE-2026-41691
• https://github.com/i18next/i18next-http-backend/commit/4cee84f229c637b9c182366d3156f726d407a621
• https://github.com/i18next/i18next-http-backend

No related operational record is retained in the current change model.