{"id":"CVE-2026-105800","published":"2026-10-06T14:48:05Z","modified":"2026-10-06T17:19:14Z","title":"i18next-http-backend incomplete URL validation permits SSRF","vendor":"i18next","product":"i18next-http-backend","tier":"tail","description":{"text":"i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.","provenance":"source","from":"CVE.org"},"cvss":{"score":3.7,"severity":"LOW","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00289,"percentile":0.21418,"provenance":"source"},"cwes":[{"id":"CWE-74","name":"Improper Neutralization of Special Elements in Output Used by a Downstream Component"},{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85","tags":["x_refsource_MISC"]},{"url":"https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2","tags":["x_refsource_MISC"]}],"priority":{"score":6.9,"factors":[{"name":"EPSS percentile","points":4.28},{"name":"CVSS severity","points":2.59}]},"vendorSlug":"i18next","affectedVersions":[{"vendor":"i18next","product":"i18next-http-backend","versions":["< 4.0.2"]}],"affected":[{"ecosystem":"npm","package":"i18next-http-backend","vulnerableRanges":["<4.0.2"],"patched":["4.0.2"],"from":["GHSA-xvq9-wjp8-hwqf"],"provenance":"source"}],"euvd":{"id":"EUVD-2026-93433","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-i18next-http-backend-cve-2026-41691","children":[{"from":"CVE-2026-105800","to":"CVE-2026-115730","relation":"successor","confidence":"high","kind":"lineage","evidence":[{"kind":"osv-related","provenance":"source","id":"GHSA-xvq9-wjp8-hwqf","via":"related"},{"kind":"version-step","provenance":"source","package":"npm:i18next-http-backend","fromFixed":"4.0.2","toFixed":"4.0.3","daysApart":17},{"kind":"similar","provenance":"machine","score":0.42,"basis":"same product + CWE + description similarity"}]}],"packageHistory":[{"cve":"CVE-2026-41691","published":"2026-05-07","fixed":"3.0.5","kev":false},{"cve":"CVE-2026-105800","published":"2026-10-06","fixed":"4.0.2","kev":false},{"cve":"CVE-2026-115730","published":"2026-10-23","fixed":"4.0.3","kev":false},{"cve":"CVE-2026-118258","published":"2026-10-28","fixed":"4.0.4","kev":false}],"package":"npm:i18next-http-backend"}}