Codeswhite

**Name of the Vulnerable Software and Affected Versions** i18next versions prior to 2.6.6 **Description** Prototype pollution occurs via crafted missing-key strings when used to persist missing translation keys. This happens when the `Backend.writeFile()` function splits queued missing-key strings using the `keySeparator` (defaulting to `.`) before calling the internal `setPath()` walker. The `getLastOfPath` function in `lib/utils.js` fails to guard against unsafe segments, allowing a key such as ` proto .polluted` to be processed as ` proto ` and `polluted`, which enables writing arbitrary properties onto the global object prototype. This can lead to application crashes, corrupted translation behavior, configuration poisoning, or the bypassing of property-based security checks. The issue is exploitable if the `missingKeyHandler` (or another route forwarding untrusted request bodies to `i18next.t(..., { ... })` with `saveMissing: true`) is accessible to untrusted users and the `keySeparator` is not set to `false`. **Recommendations** Update to version 2.6.6. As a temporary workaround, do not expose the `missingKeyHandler` of `i18next-http-middleware` to untrusted users by mounting it behind authentication or removing the route. Disable missing-key persistence by setting `saveMissing: false` or removing the `backend.create` implementation when accepting writes from untrusted input. Set `keySeparator: false` in the i18next options to disable backend key splitting.

**Name of the Vulnerable Software and Affected Versions** i18next-http-middleware versions prior to 3.9.7 i18next-fs-backend versions 2.6.5 and earlier **Description** The `missingKeyHandler` in i18next-http-middleware fails to reject dotted variants of restricted keys, such as ` proto .polluted`, while only blocking literal request-body keys like ` proto `, `constructor`, and `prototype`. When used with downstream backends that split the missing-key string using a configured `keySeparator`, such as i18next-fs-backend, these keys are passed to an unguarded `setPath()` walker that writes to `Object.prototype`. This leads to prototype pollution, a condition where an attacker can modify the prototype of base objects, potentially causing application crashes, corrupted translation behavior, configuration poisoning, or the bypassing of property-based security checks. **Recommendations** Update to version 3.9.7 or later. Update i18next-fs-backend to a version later than 2.6.5. Do not expose `missingKeyHandler` to untrusted users by mounting it behind authentication or removing the route. Implement a request-body filter before the handler to reject any top-level key containing ` proto `, `constructor`, or `prototype` after splitting on the configured `keySeparator`. Disable missing-key persistence by setting `saveMissing: false` when accepting writes from untrusted input.