CVE-2026-105800: i18next-http-backend SSRF Vulnerability Due to Incomplete URL Validation
Summary
CVE-2026-105800: i18next-http-backend incomplete URL validation permits SSRF. Affects i18next-http-backend versions < 4.0.2. Fixed in 4.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
i18next-http-backend is a widely used backend plugin for the i18next internationalization framework, enabling the loading of translation files via HTTP. It allows developers to manage language resources efficiently. However, it has a vulnerability that can lead to Server-Side Request Forgery (SSRF) due to inadequate validation of user-controlled input, specifically in the language or namespace parameters.
Vulnerability Detail
The SSRF vulnerability in i18next-http-backend arises when an attacker can manipulate the language or namespace input to include a colon, which can lead to unintended requests to external origins. This issue is particularly concerning as it allows for potential URL injection, which could expose sensitive information or allow for further exploitation of the server. The vulnerability was identified as an incomplete patch for a previous issue (CVE-2026-41691), where certain URL-control characters were not adequately blocked.
How To Fix
Latest published version: 4.0.4 as of 22 Oct 2026
npm install i18next-http-backend@4.0.4Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.0.2
This is the first release that contains the fix.
npm install i18next-http-backend@4.0.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, ensure that the loadPath or addPath template does not begin with {{lng}} or {{ns}}. Instead, use a fixed path or origin to prevent the parsing of user-controlled input as a URL scheme. For example, modify the loadPath to: '/locales/{{lng}}/{{ns}}.json'.
Conclusion
The SSRF vulnerability in i18next-http-backend (CVE-2026-105800) poses a risk due to incomplete URL validation. It is crucial to update to version 4.0.2 or later to mitigate this risk. Additionally, using Vulert can help monitor your application for vulnerabilities effectively.
See every vulnerability recorded for i18next-http-backend →
FAQ
Server-Side Request Forgery (SSRF) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to unintended destinations, potentially exposing sensitive data or services.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. By analyzing your package-lock.json file, Vulert can help identify if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to internal services, data leakage, or further exploitation of the server, posing significant security risks.
While updating is the best solution, you can temporarily mitigate the risk by adjusting the loadPath to avoid direct interpolation of user-controlled input.
The CVSS score of this vulnerability is 3.7, indicating a low severity level but still warranting attention and remediation.
References
Related vulnerabilities
Recent vulnerabilities recorded for i18next-http-backend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
