Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:i18next:i18next-Fs-Backend:*:*:*:*:*:node.js:*:*

1 brief RSS
critical advisory

i18next-fs-backend Prototype Pollution via Crafted Missing-Key String (CVE-2026-48713)

Untrusted input can exploit a prototype pollution vulnerability (CVE-2026-48713) in `i18next-fs-backend` versions prior to 2.6.6, particularly via `i18next-http-middleware`'s `missingKeyHandler`, by submitting crafted missing-key strings that leverage the `keySeparator` to write arbitrary properties onto `Object.prototype`, leading to crashes, configuration poisoning, or security bypasses.

i18next-fs-backend < 2.6.6 +1 prototype-pollution node.js web-application vulnerability
1r 1t 1c