CVE-2026-48713: i18next-fs-backend Prototype Pollution Vulnerability
Summary
CVE-2026-48713: i18next-fs-backend vulnerable to prototype pollution via crafted missing-key string. Affects i18next-fs-backend versions < 2.6.6. Fixed in 2.6.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
i18next-fs-backend is a backend plugin for the i18next internationalization framework, allowing applications to persist missing translation keys. It is widely used in Node.js applications to manage translations effectively. However, versions up to 2.6.5 are vulnerable to prototype pollution, which can lead to severe security issues if untrusted input is processed.
Vulnerability Detail
The vulnerability arises from the way i18next-fs-backend handles missing translation keys. When the missingKeyHandler is exposed to untrusted input, an attacker can craft a malicious key string that, when processed, can manipulate the global object prototype. This occurs because the Backend.writeFile() method splits the key string on the configured keySeparator, allowing keys like 'proto.polluted' to be interpreted as legitimate keys. The consequences of this vulnerability can include application crashes, corrupted translations, and potential bypasses of security checks.
How To Fix
Minimum fixed version
2.6.6
This is the first release that contains the fix.
npm install i18next-fs-backend@2.6.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrading is not possible, consider implementing the following workarounds: 1. Do not expose the missingKeyHandler to untrusted users. 2. Disable missing-key persistence by setting saveMissing: false in your i18next configuration. 3. Set keySeparator: false to prevent key splitting, though this will disable nested translation keys.
Conclusion
The i18next-fs-backend package is vulnerable to a critical prototype pollution issue in versions up to 2.6.5. It is essential to update to version 2.6.6 or implement the recommended workarounds to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for i18next-fs-backend →
FAQ
Prototype pollution is a type of vulnerability that allows an attacker to manipulate an object's prototype, potentially leading to arbitrary code execution or application instability.
You can use Vulert to monitor your application for vulnerabilities. Simply upload your package-lock.json file to the Vulert playground at Vulert Scanner to check for any issues.
Failing to address this vulnerability can lead to severe security risks, including unauthorized access to sensitive data, application crashes, and exploitation of the application by attackers.
Yes, you can implement workarounds such as disabling the missingKeyHandler for untrusted users and adjusting the configuration settings as mentioned.
The CVSS score for this vulnerability is 9.1, indicating a critical level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for i18next-fs-backend.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
