CVE-2026-48714
i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
Description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.
INFO
Published Date :
June 15, 2026, 10:16 p.m.
Last Modified :
Oct. 25, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | CRITICAL | [email protected] | ||||
| CVSS 3.1 | CRITICAL | MITRE-CVE |
Solution
- Update i18next-http-middleware to version 3.9.7.
- Limit exposure of missingKeyHandler to trusted users.
- Filter request bodies for prototype pollution keywords.
- Disable missing-key persistence with untrusted input.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-48714.
| URL | Resource |
|---|---|
| https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49 | Patch |
| https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w | Mitigation Vendor Advisory |
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-48714 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-48714
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-48714 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-48714 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Oct. 25, 2026
Action Type Old Value New Value Added Translation Title: i18next-http-middleware de i18next, Description: i18next-http-middleware es un middleware para ser usado con frameworks web de Node.js como express o Fastify y también para Deno. En versiones anteriores a la 3.9.7, el missingKeyHandler bloqueaba las claves literales del cuerpo de la solicitud __proto__, constructor y prototype (añadidas en la 3.9.3, ver GHSA-5fgg-jcpf-8jjw), pero no rechazaba variantes con puntos como ’__proto__.polluted’. Backends descendientes que dividen la cadena de clave faltante en un keySeparator configurado (notablemente i18next-fs-backend ? 2.6.5) entregan estas claves a un ’walker’ setPath() sin protección que escribe en Object.prototype. Las aplicaciones que exponen el missingKeyHandler a entrada no confiable Y usan i18next-fs-backend ? 2.6.5 son directamente explotables para la contaminación remota de prototipos. Otros backends descendientes que dividen la cadena de clave faltante de la misma manera pueden verse afectados de manera similar. Dependiendo de la aplicación anfitriona, las propiedades de prototipo contaminadas pueden causar fallos, comportamiento de traducción corrupto, envenenamiento de la configuración o derivaciones de comprobaciones de seguridad basadas en propiedades. Este problema ha sido solucionado en la versión 3.9.7. Si los desarrolladores no pueden actualizar inmediatamente, deben hacer lo siguiente: no exponer el missingKeyHandler a usuarios no confiables (montarlo detrás de autenticación, o eliminar la ruta), añadir un filtro de cuerpo de solicitud antes del gestor que rechace cualquier clave de nivel superior que contenga __proto__, constructor o prototype después de dividirla en su keySeparator configurado, y deshabilitar la persistencia de claves faltantes (saveMissing: false) al aceptar escrituras de entrada no confiable. -
Initial Analysis by [email protected]
Jun. 18, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:a:i18next:i18next-http-middleware:*:*:*:*:*:node.js:*:* versions up to (excluding) 3.9.7 Added Reference Type GitHub, Inc.: https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49 Types: Patch Added Reference Type GitHub, Inc.: https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w Types: Mitigation, Vendor Advisory -
CVE Modified by [email protected]
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'vendor': 'i18next', 'product': 'i18next-http-middleware', 'versions': [{'status': 'affected', 'version': '< 3.9.7'}]}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-48714', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'yes'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-06-16T14:50:19.973996Z'} -
New CVE Received by [email protected]
Jun. 15, 2026
Action Type Old Value New Value Added Description i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H Added CWE CWE-1321 Added Reference https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49 Added Reference https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w