Description
There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.
This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.
Recommendation
Update the i18next-http-backend package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.2
- Patched version(s): 4.0.2
References
Could your website be exposed too?
SmartScanner can check your website for i18next-http-backend incomplete URL validation permits SSRF and gives you actionable findings to investigate.
Start a free scanRelated Issues
- i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} - CVE-2026-115730
- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691
- i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query s - CVE-2026-118258
- @langchain/community affected by SSRF Bypass in RecursiveUrlLoader via insufficient URL origin validation - CVE-2026-26019
You might also like:
See something that needs correcting? Let us knowUpdated October 06, 2026