CVE-2026-55451 gettext-converter: Prototype pollution in js2i18next() via crafted translation keys
Prototype pollution in gettext-converter allows attackers to modify Object.prototype via crafted translation keys, causing denial of service or application-specific issues.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-55451?
CVE-2026-55451 is a high-severity vulnerability in locize gettext-converter, published on 14 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gettext-converter provides gettext resource conversion utilities for JavaScript. Prior to 1.3.3, js2i18next() in lib/js2i18next.js splits nested translation keys using options.keyseparator, whose default value consists of two number signs, and uses each segment as a dynamic object key without rejecting __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves Object.prototype as the nested write target and Object.assign writes attacker-controlled translated properties onto the process-wide prototype. The resulting prototype pollution can cause denial of service and may enable application-dependent follow-on attacks. This issue is fixed in version 1.3.3.
Weakness: CWE-1321
Which versions are affected by CVE-2026-55451?
2 open source packages ship an affected version, including gettext-converter.
| Package | Affected | Fixed in |
|---|---|---|
gettext-converter npm | All versions | 1.3.3 |
gettext-converter npm | All versions | 1.3.3 |
How do I fix CVE-2026-55451?
Upgrade gettext-converter to 1.3.3 or later.
Is CVE-2026-55451 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-55451 exists.
Sources
Also known as GHSA-f4jp-rw7w-ccwg.