CVE-2026-48713: I18next-fs-backend Prototype Pollution

CVE-2026-48713 Overview

CVE-2026-48713 is a prototype pollution vulnerability [CWE-1321] in i18next-fs-backend, a Node.js filesystem backend for the i18next internationalization library. Versions prior to 2.6.6 allow attackers to write arbitrary properties onto Object.prototype via crafted missing-key strings. The flaw resides in the getLastOfPath walker in lib/utils.js, which fails to validate unsafe key segments such as __proto__, constructor, or prototype. Applications become exploitable when i18next-http-middleware's missingKeyHandler is exposed to untrusted input with the default keySeparator of . in use. The maintainers released a fix in version 2.6.6.

Critical Impact
Unauthenticated network attackers can pollute Object.prototype, causing application crashes, configuration poisoning, corrupted translation behaviour, or bypasses of property-based security checks.

Affected Products

i18next-fs-backend versions prior to 2.6.6
Node.js applications using i18next with saveMissing: true and a reachable missingKeyHandler
Applications using the default keySeparator value (.) for translation key splitting

Discovery Timeline

2026-06-15 - CVE-2026-48713 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-48713

Vulnerability Analysis

The vulnerability exists in the Backend.writeFile() flow used to persist missing translation keys. When a missing-key string arrives, the backend splits it on the configured keySeparator (default .) and forwards the resulting array to the internal setPath() walker. The walker function getLastOfPath in lib/utils.js traverses object properties without filtering dangerous segment names. A key such as __proto__.polluted splits into ["__proto__", "polluted"] and walks directly into Object.prototype. Any property written there propagates to every object in the Node.js process.

Depending on the host application, polluted prototype properties may trigger crashes, corrupt translation output, poison runtime configuration, or bypass property-based authorization checks. The attack requires only network access and no authentication when the missingKeyHandler route accepts untrusted request bodies.

Root Cause

The getLastOfPath function did not validate segment names against an unsafe-key list. It accepted any string passed by the caller and used it as a property lookup on the traversal object. Combined with automatic creation of missing intermediate objects, this allowed attackers to reach and modify Object.prototype.

Attack Vector

An attacker submits a crafted translation key containing __proto__, constructor, or prototype segments through any endpoint that forwards untrusted input to i18next.t(..., { ... }) with saveMissing: true. The typical entry point is i18next-http-middleware's missingKeyHandler route exposed without authentication.

javascript

     if (!object) return {}
 
     const key = cleanKey(stack.shift())
+    // guard against prototype pollution \\u2014 refuse to traverse __proto__,
+    // constructor or prototype segments. Returning an empty result lets
+    // callers drop the write silently rather than walking into Object.prototype.
+    if (UNSAFE_KEYS.indexOf(key) > -1) return {}
     if (!object[key] && Empty) object[key] = new Empty()
     object = object[key]
   }
 
   if (!object) return {}
-  return {
-    obj: object,
-    k: cleanKey(stack.shift())
-  }
+  const k = cleanKey(stack.shift())
+  if (UNSAFE_KEYS.indexOf(k) > -1) return {}
+  return { obj: object, k }
 }
 
 export function setPath (object, path, newValue) {
   const { obj, k } = getLastOfPath(object, path, Object)
+  if (obj === undefined) return // unsafe path \\u2014 drop silently
   if (Array.isArray(obj) && isNaN(k)) throw new Error(`Cannot create property "${k}" here since object is an array`)
   obj[k] = newValue
 }
 
 export function pushPath (object, path, newValue, concat) {
   const { obj, k } = getLastOfPath(object, path, Object)

Source: GitHub Commit 3ab0448

The patch introduces an UNSAFE_KEYS allow-list check at both the traversal and final-segment steps, dropping writes silently when dangerous segments are detected.

Detection Methods for CVE-2026-48713

Indicators of Compromise

HTTP request bodies or query parameters containing __proto__, constructor.prototype, or prototype substrings sent to translation or locale endpoints
Unexpected properties appearing on plain objects across the Node.js application runtime
Application crashes or anomalous behaviour following requests to i18next-http-middlewaremissingKeyHandler routes
New or modified locale JSON files under the i18next backend loadPath directory containing suspicious key names

Detection Strategies

Review dependency manifests (package.json, package-lock.json) for i18next-fs-backend versions below 2.6.6
Inspect application routing to confirm whether missingKeyHandler or any saveMissing path is reachable by unauthenticated users
Enable HTTP request logging on translation-related endpoints and search for prototype-pollution payload patterns
Use Software Composition Analysis (SCA) tooling to flag the vulnerable component across build artifacts

Monitoring Recommendations

Alert on POST or PUT requests to i18next routes containing __proto__, constructor, or prototype tokens in the path or body
Monitor Node.js process behaviour for unexplained crashes correlated with traffic to internationalization endpoints
Track filesystem writes under translation backend directories for unexpected file or key creation

How to Mitigate CVE-2026-48713

Immediate Actions Required

Upgrade i18next-fs-backend to version 2.6.6 or later across all Node.js projects
Audit application code for any route that exposes i18next-http-middleware's missingKeyHandler to untrusted users and place it behind authentication or remove it
Disable missing-key persistence by setting saveMissing: false or omitting backend.create when accepting writes from untrusted input
Inventory all transitive uses of i18next-fs-backend via lockfile analysis to ensure complete remediation

Patch Information

The fix is contained in commit 3ab0448087da6935a40117f904b7457281f963f4 and released in i18next-fs-backend version 2.6.6. Details are published in the GitHub Security Advisory GHSA-2933-q333-qg83 and the upstream commit.

Workarounds

Mount missingKeyHandler behind authentication middleware or remove the route entirely from production routing
Set saveMissing: false in i18next initialization options to prevent persistence of attacker-controlled keys
Set keySeparator: false in i18next options to disable backend key splitting, noting that this also disables nested translation keys
Apply a Web Application Firewall (WAF) rule blocking request bodies containing __proto__, constructor, or prototype tokens directed at translation endpoints

bash

# Upgrade i18next-fs-backend to the patched release
npm install i18next-fs-backend@^2.6.6

# Verify installed version
npm ls i18next-fs-backend

# Example i18next initialization hardening
# i18next.init({
#   saveMissing: false,
#   keySeparator: false,
#   backend: { loadPath: './locales/{{lng}}/{{ns}}.json' }
# })