ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-105800

i18next-http-backend incomplete URL validation permits SSRF

Published Oct 6, 2026 · catalog updated Oct 24, 2026 · i18next-http-backend incomplete URL validation

Last checked Oct 25, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-105800. EPSS is 0.29%. Act only if a listed version of i18next-http-backend incomplete URL validation is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (i18next-http-backend incomplete URL validation).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.29%
Remediation
Advisory link
Affected products
npm i18next-http-backend

There is an SSRF vulnerability when using . A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath. ## Proof of Concept Run: The expected result is: ## Why the Previous Patch Was Incomplete This vulnerability is caused by an incomplete patch for [CVE-2026-41691](https://github.com/advisories/GHSA-q89c-q3h5-w34g). The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns. The following bypass remains in the current release: lng=http:127.0.0.1: with loadPath={{lng}}/{{ns}}.json; colon is not blocked and produces an outbound request. ## Impact The attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF. ## Recommended Fix Parse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist. Please let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report. ## Maintainer note Confirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288). **Preconditions.** The bypass only works when the / template *begins* directly with or — no origin and no leading , e.g. . Only in that position is parsed as a URL scheme. The default and every template with a leading path or origin are **not** affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an value such as to become a protocol-relative URL in browsers. **Fix.** is now rejected in both and values, and in values. No BCP-47 language code contains a

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm i18next-http-backend0 → 4.0.2

How to fix CVE-2026-105800

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-105800. EPSS is 0.29%. Act only if a listed version of i18next-http-backend incomplete URL validation is installed.

Which versions are affected?

Compare what you have installed with 0 → 4.0.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-74: Injection; CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.29%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 6, 2026 · GitHub Advisory Database

    Detected

    There is an SSRF vulnerability when using . A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath. ## Proof of Concept Run: The expected result is: ## Why the Previous Patch Was Incomplete This vulnerabil

  2. Oct 24, 2026 · GitHub Advisory Database

    Fix available

    i18next-http-backend fixed in 4.0.2

  3. Oct 24, 2026 · GitHub Advisory Database

    Fix available

    i18next-http-backend fixed in 4.0.2

  4. Oct 24, 2026 · GitHub Advisory Database

    Updated

    There is an SSRF vulnerability when using . A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath. ## Proof of Concept Run: The expected result is: ## Why the Previous Patch Was Incomplete This vulnerabil

Sources

References

Freshness

Last verified in this catalog Oct 24, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • GitHub Advisory DatabaseOct 25, 2026
  • OpenSSF OSV / OSV ScannerOct 25, 2026
  • CVE.orgOct 24, 2026
  • FIRST EPSSOct 24, 2026