CVE-2026-41683 HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header
Attackers can inject CRLF sequences into HTTP headers causing response splitting and denial of service in Node.js applications using vulnerable i18next middleware.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41683?
CVE-2026-41683 is a high-severity vulnerability in i18next-http-middleware, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.
Which versions are affected by CVE-2026-41683?
2 open source packages ship an affected version, including i18next-http-middleware.
| Package | Affected | Fixed in |
|---|---|---|
i18next-http-middleware npm | All versions | 3.9.3 |
i18next-http-middleware npm | All versions | 3.9.3 |
How do I fix CVE-2026-41683?
Upgrade i18next-http-middleware to 3.9.3 or later.
Is CVE-2026-41683 being exploited?
There is no known exploitation of CVE-2026-41683 in the wild and no public exploit code.
Sources
Also known as GHSA-c3h8-g69v-pjrg.