CVE-2026-118258

Name of the Vulnerable Software and Affected Versions i18next-http-backend versions prior to 4.0.4

Description The interpolateUrl function inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, they can perform query-string injection (HTTP parameter pollution). This allows the attacker to add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior by leveraging the application's network position and credentials.

Technical details include:

Recommendations Update i18next-http-backend to version 4.0.4 or later. As a temporary workaround, avoid using loadPath or addPath templates that place {{lng}} or {{ns}} within the query string.