ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-118258

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

Published Oct 28, 2026 · catalog updated Oct 28, 2026 · Red Hat Red Hat Enterprise Linux

Last checked Nov 7, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118258. EPSS is 0.28%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Gaps on this record

  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
Low3.7
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.28%
Remediation
Version ranges on file
Affected products
npm i18next-http-backend

### Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks , , , , and in , but not or , and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form . With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from , a cookie or . This is the "query-string injection" impact described in GHSA-q89c; only the form was closed. Server side (Express + i18next-http-middleware, default options), makes the application request from its own translations API. ### Details The checks are in . The base check (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/utils.js#L26-L44) rejects: - empty or >128-character values and prototype keys; - and ; - ; - control characters. (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/utils.js#L51-L55) adds only and . **Neither function rejects or .** then splits on , checks each segment, and joins the **raw** segments into the template, with no encoding (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/utils.js#L159-L184, return at L174). Call sites: - builds the load URL with : https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/index.js#L64 - builds the missing-key URL with : https://github.com/i18next/i18next-http-backend/blob/v4.0.3/lib/index.js#L133 The README documents the query-shaped URL for multiloading (https://github.com/i18next/i18next-http-backend/blob/v4.0.3/README.md?plain=1#L130). The language value is attacker-controlled in normal setups, as GHSA-q89c itself says: detectors read , cookies, and request headers. i18next-http-middleware's does the same on the server. Where is placed in the template determines which characters are structural. The fix treated only the path position. In a query position, and are the separators, so they must be rejected or encoded too. **Suggested fix.** Reject and (

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • npm i18next-http-backend< 4.0.4

How to fix CVE-2026-118258

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-118258. EPSS is 0.28%. Act only if a listed version of Red Hat Red Hat Enterprise Linux is installed.

Which versions are affected?

Compare what you have installed with < 4.0.4. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-140; CWE-74: Injection. EPSS 0.28%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 28, 2026 · GitHub Advisory Database

    Detected

    ### Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks , , , , and in , but not or , and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form . With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from ,

  2. Oct 28, 2026 · GitHub Advisory Database

    Updated

    ### Summary The URL-segment check added for GHSA-q89c-q3h5-w34g blocks , , , , and in , but not or , and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form . With a template like that, an attacker who controls the language value can add or override query parameters on the request the backend sends. By default the language comes from ,

Sources

  • CVE.orgVulnerability recordCVE-2026-118258

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-118258

    30-day exploitation probability 0.28%

    first.org
  • GitHub Advisory DatabasePackage advisoryGHSA-3cmx-xjww-583x

    i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

    github.com
  • GitLab Advisory DatabasePackage advisoryCVE-2026-118258

    The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, #, %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2. With a template like that, an attacker who controls the language value can add or override query parameters on the request the backe

    advisories.gitlab.com
  • Red Hat Security DataVendor advisoryCVE-2026-118258

    i18next-http-backend: i18next-http-backend: Information disclosure via query parameter injection

    access.redhat.com

References

Freshness

Last verified in this catalog Nov 7, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • FIRST EPSSNov 7, 2026
  • GitLab Advisory DatabaseOct 30, 2026
  • Red Hat Security DataOct 30, 2026
  • CVE.orgOct 29, 2026
  • GitHub Advisory DatabaseOct 29, 2026