CVE-2026-41690 Overview
CVE-2026-41690 is a prototype pollution vulnerability affecting i18next-http-middleware, a localization middleware used with Node.js web frameworks including Express, Fastify, and Deno. Versions prior to 3.9.3 expose two unvalidated entry points, getResourcesHandler and missingKeyHandler, that reach internal object-key writes. An unauthenticated remote HTTP client can pollute Object.prototype in the Node.js process hosting the middleware. The flaw is tracked under CWE-22 and carries an EPSS probability of 0.099%.
Critical Impact
Attackers can bypass authorization checks, trigger type-confusion denial of service, and potentially achieve remote code execution depending on downstream code paths.
Affected Products
- i18next-http-middleware versions prior to 3.9.3
- Node.js applications using Express or Fastify with the affected middleware
- Deno applications using the affected middleware
Discovery Timeline
- 2026-05-08 - CVE-2026-41690 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-41690
Vulnerability Analysis
The vulnerability resides in two HTTP-facing handlers exported by i18next-http-middleware. The getResourcesHandler and missingKeyHandler functions accept client-controlled input and write it into internal objects without validating the property keys. When attacker input includes keys such as __proto__, constructor, or prototype, the writes traverse the prototype chain and modify Object.prototype for the entire Node.js process.
Once Object.prototype is polluted, every object in the runtime inherits the attacker-controlled properties. Authorization checks such as if (user.isAdmin) return true for any user when isAdmin has been injected at the prototype level. Type-confusion conditions can crash the process, producing a denial-of-service condition. Gadget chains in downstream code may escalate the pollution into remote code execution.
Root Cause
The root cause is missing input validation on property names supplied through HTTP requests. The handlers use recursive or dynamic key assignment without filtering reserved keys like __proto__ and constructor.prototype. This pattern aligns with CWE-22 traversal semantics applied to JavaScript object property graphs.
Attack Vector
An unauthenticated attacker sends a crafted HTTP request to an endpoint backed by getResourcesHandler or missingKeyHandler. The request body or query parameters contain reserved property names that the middleware writes into internal storage. The write reaches Object.prototype, persisting across all subsequent requests in the process. No authentication, user interaction, or special privileges are required.
The vulnerability mechanism is documented in the GitHub Security Advisory GHSA-5fgg-jcpf-8jjw.
Detection Methods for CVE-2026-41690
Indicators of Compromise
- HTTP requests containing __proto__, constructor, or prototype keys in JSON bodies or query parameters targeting i18next endpoints
- Unexpected properties appearing on objects across unrelated request handlers in application logs
- Node.js process crashes referencing type errors on inherited properties shortly after suspicious requests
Detection Strategies
- Inspect web server and application logs for request payloads containing reserved JavaScript property names sent to localization or missing-key reporting endpoints.
- Deploy WAF rules that block JSON and query parameters containing __proto__ or constructor.prototype patterns.
- Audit installed Node.js dependencies and flag any application running i18next-http-middleware at a version below 3.9.3.
Monitoring Recommendations
- Monitor Node.js process telemetry for anomalous restarts, unhandled exceptions, and memory growth following inbound HTTP traffic spikes.
- Track authorization decisions in application logs and alert on privilege grants that bypass expected role assignments.
- Continuously inventory Node.js package versions in production through software composition analysis tooling.
How to Mitigate CVE-2026-41690
Immediate Actions Required
- Upgrade i18next-http-middleware to version 3.9.3 or later in all Node.js, Express, Fastify, and Deno deployments.
- Audit application code for use of getResourcesHandler and missingKeyHandler and validate that these endpoints are not exposed publicly without filtering.
- Review authorization logic that relies on truthy property checks and refactor to use Object.hasOwn() or hasOwnProperty semantics.
Patch Information
The maintainers fixed the vulnerability in i18next-http-middleware version 3.9.3. The patch validates property keys to reject reserved names before performing object writes. See the GitHub Security Advisory for full remediation details.
Workarounds
- Restrict access to the i18next resource and missing-key endpoints with authentication middleware or network-layer ACLs until the patch is applied.
- Add an input-sanitization layer that strips __proto__, constructor, and prototype keys from incoming request bodies and query strings.
- Freeze Object.prototype at application startup with Object.freeze(Object.prototype) to prevent prototype writes globally, after verifying no legitimate code depends on prototype mutation.
# Configuration example
npm install i18next-http-middleware@^3.9.3
npm audit --production
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
