Description
The URL-segment check added for GHSA-q89c-q3h5-w34g blocks ?, #, %, :, / and @ in lng, but not & or =, and the checked value is inserted into the URL without encoding. The README documents a multiload loadPath of the form /locales/resources.json?lng=de+en&ns=ns1+ns2.
Recommendation
Update the i18next-http-backend package to the latest compatible version. Followings are version details:
- Affected version(s): < 4.0.4
- Patched version(s): 4.0.4
References
Could your website be exposed too?
SmartScanner can check your website for i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query s and gives you actionable findings to investigate.
Start a free scanRelated Issues
- i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} - CVE-2026-115730
- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns - CVE-2026-41691
- i18next-http-backend incomplete URL validation permits SSRF - CVE-2026-105800
- i18next-locize-backend has URL Injection via Unsanitized Path Parameters - CVE-2026-41885
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026