CVE-2026-48714Critical· 9.1▾ Midnighti18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 4.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.5%
i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype.
Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected.
Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks.
Fixed in i18next-http-middleware 3.9.7. A new utils.hasUnsafeKeySegment(key, keySeparator) helper is now used by missingKeyHandler; the configured i18next.options.keySeparator is honoured (default .; false disables segment splitting and only the literal-key denylist applies). Legitimate dotted keys (e.g. "header.title") are unaffected.
The root-cause fix has been shipped in i18next-fs-backend 2.6.6 — see the companion advisory.
If users cannot upgrade immediately:
missingKeyHandler to untrusted users (mount it behind authentication, or remove the route).__proto__, constructor, or prototype after splitting on a configured keySeparator.saveMissing: false) when accepting writes from untrusted input.i18next-fs-backend: GHSA-2933-q333-qg83.i18next-http-middleware security release: GHSA-5fgg-jcpf-8jjw and GHSA-c3h8-g69v-pjrg (in 3.9.3).i18next-http-middleware < 3.9.7Upgrade to a patched release:
i18next-http-middleware 3.9.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-61534Critical· 9.1Yayson is a library for serializing and reading JSON API data in JavaScript
CVE-2026-86078Medium· 6.5n8n is an open source workflow automation platform
CVE-2026-84367Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-84368Low· 3.7joi is a schema description language and data validator for JavaScript
CVE-2026-85063Medium· 6.5node-csv is a full-featured CSV parser with a simple API that is tested against large datasets
CVE-2026-63376High· 8.2toml-node is a TOML parser for Node.js and the browser