CVE-2026-105800 i18next-http-backend incomplete URL validation permits SSRF
Attackers can trigger SSRF or URL injection in i18next-http-backend by manipulating language or namespace values in custom load paths.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-105800?
CVE-2026-105800 is a low-severity server-side request forgery vulnerability in i18next-http-backend, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
Which versions are affected by CVE-2026-105800?
2 open source packages ship an affected version, including i18next-http-backend.
| Package | Affected | Fixed in |
|---|---|---|
i18next-http-backend npm | All versions | 4.0.2 |
i18next-http-backend npm | All versions | 4.0.2 |
How do I fix CVE-2026-105800?
Upgrade i18next-http-backend to 4.0.2 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-105800 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-105800 exists.
Sources
Also known as CLSA-2026-1792233117, CLSA-2026-1792233236, DEBIAN-CVE-2026-105800, GHSA-xvq9-wjp8-hwqf, UBUNTU-CVE-2026-105800.