CVE-2026-41690 Prototype pollution and path traversal in i18next-http-middleware via user-controlled language and namespace parameters
Unauthenticated attackers can pollute prototypes via path traversal, leading to authorization bypass and potential remote code execution in Node.js applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-41690?
CVE-2026-41690 is a high-severity path traversal vulnerability in i18next-http-middleware, published on 8 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
Which versions are affected by CVE-2026-41690?
2 open source packages ship an affected version, including i18next-http-middleware.
| Package | Affected | Fixed in |
|---|---|---|
i18next-http-middleware npm | All versions | 3.9.3 |
i18next-http-middleware npm | All versions | 3.9.3 |
How do I fix CVE-2026-41690?
Upgrade i18next-http-middleware to 3.9.3 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-41690 being exploited?
There is no known exploitation of CVE-2026-41690 in the wild and no public exploit code.
Sources
Also known as GHSA-5fgg-jcpf-8jjw.