What’s Vulnerable › Products

i18next-http-backend vulnerabilities

4 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 4 published in the last 12 months.

Check whether your i18next-http-backend version is affected

Latest i18next-http-backend vulnerabilities

• CVE-2026-118258 — i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string (CVSS 3.7)
• CVE-2026-115730 — i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl (CVSS 3.1)
• CVE-2026-105800 — i18next-http-backend incomplete URL validation permits SSRF (CVSS 3.7)
• CVE-2026-41691 — i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns (CVSS 9.1)