CVE-2026-41885 Overview
CVE-2026-41885 is a path traversal vulnerability [CWE-22] in i18next-locize-backend, an i18next backend for locize.com used in Node.js, browsers, and Deno. Versions prior to 9.0.2 interpolate lng, ns, projectId, and version directly into URL templates without path-component validation or encoding. Applications that expose these values to user-controlled input allow attackers to alter the structure of outgoing request URLs. The maintainers patched the issue in version 9.0.2.
Critical Impact
Attackers can manipulate outbound request URLs to reach unintended endpoints, leak translation data across projects, or interact with attacker-controlled paths on the configured backend host.
Affected Products
- i18next-locize-backend versions prior to 9.0.2
- Node.js applications using the affected backend
- Browser and Deno applications using the affected backend
Discovery Timeline
- 2026-05-08 - CVE-2026-41885 published to NVD
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-41885
Vulnerability Analysis
The vulnerability stems from unsafe string interpolation in URL template construction. The interpolate() helper in lib/utils.js substitutes raw values into URL templates without encoding or path-component validation. Five call sites in lib/index.js use this helper to build request URLs: _readAny/read at line 415 for private paths and line 426 for public paths, getLanguages at lines 271 and 296, and writePage at lines 616 and 622 for missing-key and update POST requests.
Each call site assembles URLs from the configured loadPath, privatePath, addPath, updatePath, or getLanguagesPath templates. The templates contain placeholders for lng, ns, projectId, and version. When an attacker controls any of these values, characters such as /, .., ?, or # pass through unmodified into the final URL.
Root Cause
The interpolate() helper performs literal substitution. It does not call encodeURIComponent() and does not validate that substituted values remain within a single URL path component. This violates the implicit contract that template variables represent opaque identifiers, not URL fragments.
Attack Vector
Applications commonly source lng and ns values from query parameters via i18next-browser-languagedetector, from cookies, from request headers, or from URL-derived projectId values. An attacker submits a crafted value such as ../otherproject/version/segment for the lng parameter. The interpolated URL then traverses outside the intended path or appends attacker-controlled query strings. This can cause the backend to fetch translations from an unintended project, leak data across tenants, or send write requests to unexpected endpoints. The vulnerability requires no authentication and no user interaction when the host application exposes these inputs.
No public proof-of-concept code is available. Refer to the GitHub Security Advisory GHSA-mgcp-mfp8-3q45 for additional technical context.
Detection Methods for CVE-2026-41885
Indicators of Compromise
- Outbound HTTP requests to locize.app or configured backends containing .., %2e%2e, or unexpected / characters in path segments derived from lng, ns, projectId, or version.
- Application logs showing translation requests with anomalous language codes or namespace names containing path separators or URL metacharacters.
- Unexpected cross-project translation reads or missing-key writes targeting projectId values not owned by the application.
Detection Strategies
- Inspect HTTP client logs from servers running i18next-locize-backend for request paths that deviate from the configured template structure.
- Audit application code for direct assignment of request-derived values to i18next options without allowlist validation.
- Compare installed i18next-locize-backend versions against 9.0.2 across Node.js dependency manifests and lockfiles.
Monitoring Recommendations
- Enable egress logging on application servers and alert on locize API requests containing encoded traversal sequences.
- Monitor Software Composition Analysis (SCA) output for the affected package and version range in CI/CD pipelines.
- Track 4xx and 5xx responses from the locize backend that may indicate failed traversal attempts.
How to Mitigate CVE-2026-41885
Immediate Actions Required
- Upgrade i18next-locize-backend to version 9.0.2 or later in all Node.js, browser, and Deno projects.
- Audit all i18next configurations that source lng, ns, projectId, or version from user-controlled inputs such as query parameters, cookies, or headers.
- Apply an allowlist for supported language codes and namespaces before passing them to i18next.
Patch Information
The maintainers released version 9.0.2, which adds path-component validation and encoding to the interpolate() helper. See the GitHub Security Advisory GHSA-mgcp-mfp8-3q45 for the full patch details.
Workarounds
- Validate lng and ns values against a fixed allowlist of supported languages and namespaces before initializing i18next.
- Strip or reject any input containing /, \, ., ?, #, or URL-encoded equivalents prior to use in i18next configuration.
- Hardcode projectId and version server-side rather than deriving them from request data.
# Upgrade the affected package
npm install i18next-locize-backend@^9.0.2
# Verify the installed version
npm ls i18next-locize-backend
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
