fix(deps): update dependency i18next-http-backend to v4 [security] by renovate[bot] · Pull Request #881 · stenic/ledger

renovate · 2026-08-26T19:57:43Z

This PR contains the following updates:

Package	Change	Age	Confidence
i18next-http-backend	`^2.1.1` → `^4.0.0`

i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

CVE-2026-41691 / GHSA-q89c-q3h5-w34g

More information

Details

Summary

Versions of i18next-http-backend prior to 3.0.5 interpolate the lng and ns values directly into the configured loadPath / addPath URL template without any encoding, validation, or path sanitisation. When an application exposes the language-code selection to user-controlled input (the default — i18next-browser-languagedetector reads ?lng= query params, cookies, localStorage, and request headers), an attacker can inject characters that change the structure of the outgoing request URL.

Affected call sites:

_readAny — lib/index.js:64: interpolate(resolvedLoadPath, { lng: languages.join('+'), ns: namespaces.join('+') })
create — lib/index.js:123 (pre-patch): interpolate(addPath, { lng, ns: namespace })

The helper interpolate (lib/utils.js) previously returned the raw value with no encoding. In contrast, addQueryString already correctly uses encodeURIComponent for each query-string param — only the URL-path substitution was unprotected.

Impact

An attacker who can influence the resolved lng or ns value can alter the URL in several ways:

Path traversal — lng = '../../config' turns /locales//.json into /locales/../../config/translation.json. On a misconfigured web server, this can cause the request to target a different resource than intended; in SSR pipelines that use file:// or similar schemes for loadPath, it can read arbitrary files from the host filesystem.
Query-string injection — lng = 'en?admin=true' turns /locales//.json into /locales/en?admin=true/translation.json. Some server frameworks parse the query portion with higher priority than the path and branch on attacker-controlled flags.
Fragment truncation — lng = 'en#anything' silently discards the rest of the path in browser fetches (client cannot see the final URL).
URL-encoded bypasses — lng = 'en%2F..', after server-side URL decoding, resolves to en/.. — the attacker bypasses the absence of a literal / in their input.

The practical worst case is SSRF when loadPath is an internal or file-scheme URL, and path-based authorisation bypass against servers that segment access by URL prefix.

Also fixed in 3.0.5

Per-instance omitFetchOptions. A module-level boolean in lib/request.js was flipped to true the first time any backend instance hit a "not implemented" fetch error. Once flipped, all subsequent requests from all backend instances in the same module silently stripped every user-configured fetch option — including security-relevant credentials, mode, and cache. One misbehaving instance (for example during SSR hydration or in React Native) permanently removed these protections process-wide. 3.0.5 scopes the flag to the backend's options object (options._omitFetchOptions) so one instance's fallback cannot pollute siblings.
Log forging via control characters in lng/ns. Error callbacks embedded the raw lng/ns/URL in the message string. Crafted CR/LF values could inject fake log lines into file-backed log aggregators (CWE-117). 3.0.5 strips C0/C1 control chars before concatenation.
Basic-auth credentials leaked into error callbacks. If loadPath contained a user:password@host authority, the full URL (including the credentials) ended up in the error message strings returned to the caller. 3.0.5 redacts user:password@ before logging.
Prototype-pollution amplification via for...in. addQueryString and the XHR customHeaders loop used for...in which walks the prototype chain. Polluted Object.prototype entries could leak into URL query parameters and request headers. 3.0.5 uses Object.keys and an explicit prototype-key guard.

Affected versions

All versions of i18next-http-backend prior to 3.0.5.

Patch

Fixed in 3.0.5. Summary of the hardening:

New utils.interpolateUrl (used by _readAny and create) returns null if any substitution fails the URL-segment safety check (blocks .., /, \, ?, #, %, @, whitespace, control chars, prototype keys, and values > 128 chars). Multi-language joins (en+de) are validated per-segment. The call sites now refuse to issue a request when the check fails and call back with a clear error.
omitFetchOptions is stored per-instance on options._omitFetchOptions.
Error-callback messages sanitise strings and redact URL credentials.
for...in over untrusted objects replaced with Object.keys + prototype-key guard.

Workarounds

No workaround short of upgrading. If you cannot upgrade immediately, sanitise lng / ns yourself before they reach i18next (strip .., /, \, ?, #, %, whitespace, and control characters; cap the length).

Credits

Discovered via an internal security audit of the i18next ecosystem.

Severity

CVSS Score: 6.5 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

i18next-http-backend incomplete URL validation permits SSRF

CVE-2026-105800 / GHSA-xvq9-wjp8-hwqf

More information

Details

There is an SSRF vulnerability when using i18next-http-backend. A colon in an attacker-controlled language value can make a custom path template request an unintended origin.

This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath.

Proof of Concept

// SSRF through a colon-only URL scheme in i18next-http-backend interpolation.
const http = require("node:http");
const Backend = require("i18next-http-backend");

function read(backend, lng, ns) {
  return new Promise((resolve) => {
    backend.read(lng, ns, (err) => resolve(err));
  });
}

async function main() {
  let gotRequest = false;
  const server = http.createServer((req, res) => {
    gotRequest = req.url === "/common.json";
    res.writeHead(200, { "content-type": "application/json" });
    res.end("{}");
  });

  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
  const backend = new Backend(null, { loadPath: "/.json" });
  const lng = `http:127.0.0.1:${server.address().port}`;

  const err = await read(backend, lng, "common");
  server.close();

  const vulnerable = gotRequest && !err;
  console.log(vulnerable ? "VULNERABLE" : "SAFE");
  if (!vulnerable) process.exitCode = 1;
}

main();

Run:

npm install --ignore-scripts
node poc.js

The expected result is:

VULNERABLE

Why the Previous Patch Was Incomplete

This vulnerability is caused by an incomplete patch for CVE-2026-41691. The previous patch addressed the following behavior: Original hardening blocks path traversal and selected URL-control characters in lng/ns.

The following bypass remains in the current release: lng=http:127.0.0.1: with loadPath=/.json; colon is not blocked and produces an outbound request.

Impact

The attacker-controlled language or namespace value can redirect the backend request to an unintended origin, resulting in URL injection and possible SSRF.

Recommended Fix

Parse the final URL and require it to remain within the intended origin and path. If absolute URLs are supported, validate them against an explicit allowlist.

Please let us know if you need any additional information or clarification. We are happy to prepare a pull request if that would be helpful. Thank you for reviewing this report.

Maintainer note

Confirmed and fixed in 4.0.2 (commit i18next/i18next-http-backend@07e0288).

Preconditions. The bypass only works when the loadPath / addPath template begins directly with or — no origin and no leading /, e.g. /.json. Only in that position is http: parsed as a URL scheme. The default /locales//.json and every template with a leading path or origin are not affected: a colon inside a path segment has no structural meaning there, and the resulting string is rejected as an invalid URL. The same template shape also allowed an ns value such as //evil.example/x to become a protocol-relative URL in browsers.

Fix. : is now rejected in both lng and ns values, and // in ns values. No BCP-47 language code contains a colon, and : is i18next's default namespace separator, so no usable namespace name does either.

Affected range. Versions before 3.0.5 had no validation at all and are reachable through this vector too, so the affected range is < 4.0.2 rather than >= 3.0.5, <= 4.0.1.

Severity

CVSS Score: 3.7 / 10 (Low)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

i18next/i18next-http-backend (i18next-http-backend)

Conversation

renovate Bot commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

Details

Summary

Impact

Also fixed in 3.0.5

Affected versions

Patch

Workarounds

Credits

Severity

References

i18next-http-backend incomplete URL validation permits SSRF

Details

Proof of Concept

Why the Previous Patch Was Incomplete

Impact

Recommended Fix

Maintainer note

Severity

References

Release Notes

Configuration

Uh oh!

stale Bot commented Oct 3, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Aug 26, 2026 •

edited

Loading