CVE-2026-48714 i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names
Attackers can achieve remote prototype pollution via crafted keys in missingKeyHandler when using vulnerable i18next-fs-backend, potentially leading to code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-48714?
CVE-2026-48714 is a critical unsafe deserialization vulnerability in i18next-http-middleware, published on 15 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.
Weakness: CWE-1321
Which versions are affected by CVE-2026-48714?
2 open source packages ship an affected version, including i18next-http-middleware. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
i18next-http-middleware npm | All versions | 3.9.7 |
i18next-http-middleware npm | All versions | 3.9.7 |
Products include I18next I18next-Http-Middleware.
How do I fix CVE-2026-48714?
Upgrade i18next-http-middleware to 3.9.7 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-48714 being exploited?
There is no known exploitation of CVE-2026-48714 in the wild and no public exploit code.
Sources
Also known as GHSA-f49m-vf83-692w, MINI-vwr9-jcqh-qvcf.