i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno

Overview

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

Package advisory (CVE-2026-105800)

Affected packages:

• i18next-http-backend < 4.0.2

Patched in:

• i18next-http-backend 4.0.2

Source: https://github.com/advisories/GHSA-xvq9-wjp8-hwqf