CVE-2026-48713

Name of the Vulnerable Software and Affected Versions i18next versions prior to 2.6.6

Description Prototype pollution occurs via crafted missing-key strings when used to persist missing translation keys. This happens when the Backend.writeFile() function splits queued missing-key strings using the keySeparator (defaulting to .) before calling the internal setPath() walker. The getLastOfPath function in lib/utils.js fails to guard against unsafe segments, allowing a key such as proto .polluted to be processed as proto and polluted, which enables writing arbitrary properties onto the global object prototype. This can lead to application crashes, corrupted translation behavior, configuration poisoning, or the bypassing of property-based security checks. The issue is exploitable if the missingKeyHandler (or another route forwarding untrusted request bodies to i18next.t(..., { ... }) with saveMissing: true) is accessible to untrusted users and the keySeparator is not set to false.

Recommendations Update to version 2.6.6. As a temporary workaround, do not expose the missingKeyHandler of i18next-http-middleware to untrusted users by mounting it behind authentication or removing the route. Disable missing-key persistence by setting saveMissing: false or removing the backend.create implementation when accepting writes from untrusted input. Set keySeparator: false in the i18next options to disable backend key splitting.