CVE catalog

CVE-2026-115730

node-i18next-http-backend: CVE-2026-115730

[CVE catalog]

Severity
Low · CVSS 3.1CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.22% · Oct 25, 2026

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-i18next-http-backendsid2.4.1+ds-2not affected
Debiannode-i18next-http-backendforky2.4.1+ds-2not affected
Debiannode-i18next-http-backendtrixie2.4.1+ds-2not affected
Debiannode-i18next-http-backendbookworm2.1.1-1not affected
Ubuntunode-i18next-http-backend22.041.0.21+dfsg-1vulnerable
Ubuntunode-i18next-http-backend22.041.3.1+dfsg-2vulnerable
Ubuntunode-i18next-http-backend22.041.3.1+dfsg-3vulnerable
Ubuntunode-i18next-http-backend22.041.3.1+dfsg-4vulnerable
Ubuntunode-i18next-http-backend22.041.3.2+dfsg-1vulnerable
Ubuntunode-i18next-http-backend24.042.1.1-1vulnerable
Ubuntunode-i18next-http-backend24.042.4.1+ds-2vulnerable
Ubuntunode-i18next-http-backend24.042.4.1+ds-2build2vulnerable
Ubuntunode-i18next-http-backend26.102.4.1+ds-2build2vulnerable
Ubuntunode-i18next-http-backend26.042.4.1+ds-2build2vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-i18next-http-backendsourcesidNot affectedunimportantNot reportedNot reported
Debiannode-i18next-http-backendsourceforkyNot affectedunimportantNot reportedNot reported
Debiannode-i18next-http-backendsourcetrixieNot affectedunimportantNot reportedNot reported
Debiannode-i18next-http-backendsourcebookwormNot affectedunimportantNot reportedNot reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libjs-i18next-http-backend]Not affected

    Source package: [node-i18next-http-backend]

    Details (2)

    • 2.1.1-1 · all · bookworm

      Not affected

      dsa · node-i18next-http-backend · debian · bookworm

    • 2.1.1-1 · all · bookworm

      Not affected

      dsa · node-i18next-http-backend · debian · bookworm

  • [node-i18next-http-backend]Not affected
    Details (2)

    • 2.1.1-1 · all · bookworm

      Not affected

      dsa · node-i18next-http-backend · debian · bookworm

    • 2.1.1-1 · all · bookworm

      Not affected

      dsa · node-i18next-http-backend · debian · bookworm

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]