CVE-2026-48714

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.7 i18next-fs-backend versions 2.6.5 and earlier

Description The missingKeyHandler in i18next-http-middleware fails to reject dotted variants of restricted keys, such as proto .polluted, while only blocking literal request-body keys like proto, constructor, and prototype. When used with downstream backends that split the missing-key string using a configured keySeparator, such as i18next-fs-backend, these keys are passed to an unguarded setPath() walker that writes to Object.prototype. This leads to prototype pollution, a condition where an attacker can modify the prototype of base objects, potentially causing application crashes, corrupted translation behavior, configuration poisoning, or the bypassing of property-based security checks.

Recommendations Update to version 3.9.7 or later. Update i18next-fs-backend to a version later than 2.6.5. Do not expose missingKeyHandler to untrusted users by mounting it behind authentication or removing the route. Implement a request-body filter before the handler to reject any top-level key containing proto, constructor, or prototype after splitting on the configured keySeparator. Disable missing-key persistence by setting saveMissing: false when accepting writes from untrusted input.