PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-48714 i18next CVE debrief

CVE-2026-48714 is a remote prototype pollution vulnerability in i18next-http-middleware versions prior to 3.9.7. The vulnerability occurs when the missingKeyHandler is exposed to untrusted input and used with i18next-fs-backend ≤ 2.6.5. This allows an attacker to pollute the Object.prototype, potentially leading to crashes, corrupted translation behavior, configuration poisoning, or bypasses of property-based security checks.

Vendor
i18next
Product
i18next-http-middleware
CVSS
CRITICAL 9.1
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-15
Original CVE updated
2026-06-18
Advisory published
2026-06-15
Advisory updated
2026-06-18

Who should care

Developers using i18next-http-middleware versions prior to 3.9.7, especially those using i18next-fs-backend ≤ 2.6.5, should be aware of this vulnerability.

Technical summary

The missingKeyHandler in i18next-http-middleware versions prior to 3.9.7 did not properly reject dotted variants of __proto__, constructor, and prototype. When used with i18next-fs-backend ≤ 2.6.5, this allows an attacker to write to Object.prototype, leading to potential security issues.

Defensive priority

CRITICAL

Recommended defensive actions

  • Upgrade to i18next-http-middleware version 3.9.7 or later.
  • Do not expose missingKeyHandler to untrusted users.
  • Add a request-body filter to reject any top-level key containing __proto__, constructor, or prototype.
  • Disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.

Evidence notes

This vulnerability has been fixed in version 3.9.7 of i18next-http-middleware.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-48714 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-48714

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-48714 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48714

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.