PatchSiren cyber security CVE debrief
CVE-2026-48714 i18next CVE debrief
CVE-2026-48714 is a remote prototype pollution vulnerability in i18next-http-middleware versions prior to 3.9.7. The vulnerability occurs when the missingKeyHandler is exposed to untrusted input and used with i18next-fs-backend ≤ 2.6.5. This allows an attacker to pollute the Object.prototype, potentially leading to crashes, corrupted translation behavior, configuration poisoning, or bypasses of property-based security checks.
- Vendor
- i18next
- Product
- i18next-http-middleware
- CVSS
- CRITICAL 9.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-15
- Original CVE updated
- 2026-06-18
- Advisory published
- 2026-06-15
- Advisory updated
- 2026-06-18
Who should care
Developers using i18next-http-middleware versions prior to 3.9.7, especially those using i18next-fs-backend ≤ 2.6.5, should be aware of this vulnerability.
Technical summary
The missingKeyHandler in i18next-http-middleware versions prior to 3.9.7 did not properly reject dotted variants of __proto__, constructor, and prototype. When used with i18next-fs-backend ≤ 2.6.5, this allows an attacker to write to Object.prototype, leading to potential security issues.
Defensive priority
CRITICAL
Recommended defensive actions
- Upgrade to i18next-http-middleware version 3.9.7 or later.
- Do not expose missingKeyHandler to untrusted users.
- Add a request-body filter to reject any top-level key containing __proto__, constructor, or prototype.
- Disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.
Evidence notes
This vulnerability has been fixed in version 3.9.7 of i18next-http-middleware.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-48714 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-48714
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-48714 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-48714
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49
-
Source reference
Unverified legacy reference
URL: https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.