CVE-2026-48714: I18next-http-middleware Vulnerability

CVE-2026-48714 Overview

CVE-2026-48714 is a prototype pollution vulnerability in i18next-http-middleware, a localization middleware used with Node.js frameworks like Express, Fastify, and Deno. Versions prior to 3.9.7 blocked literal request-body keys such as __proto__, constructor, and prototype, but failed to reject dotted variants like __proto__.polluted. Downstream backends that split missing-key strings on a configured keySeparator, notably i18next-fs-backend ≤ 2.6.5, pass these keys to an unguarded setPath() walker that writes to Object.prototype. Applications exposing missingKeyHandler to untrusted input are directly exploitable for remote prototype pollution. The issue is fixed in version 3.9.7.

Critical Impact
Unauthenticated attackers can pollute Object.prototype remotely, leading to application crashes, corrupted translations, configuration poisoning, or bypasses of property-based security checks [CWE-1321].

Affected Products

i18next-http-middleware versions prior to 3.9.7
Applications combining i18next-http-middleware with i18next-fs-backend ≤ 2.6.5
Node.js web applications using Express, Fastify, or Deno that expose missingKeyHandler to untrusted users

Discovery Timeline

2026-06-15 - CVE-2026-48714 published to NVD
2026-06-18 - Last updated in NVD database

Technical Details for CVE-2026-48714

Vulnerability Analysis

The vulnerability resides in the missingKeyHandler route of i18next-http-middleware. The pre-3.9.7 implementation iterated over request-body keys and skipped values appearing in an UNSAFE_KEYS denylist containing __proto__, constructor, and prototype. This literal-only check is insufficient.

When the upstream key __proto__.polluted reaches a backend that splits keys on the configured keySeparator (default .), the backend invokes a recursive setPath() function. That walker descends through obj["__proto__"]["polluted"], writing attacker-controlled values onto Object.prototype. Every object in the running process inherits the polluted property.

Downstream effects include denial of service through unexpected property reads, corrupted translation output, configuration poisoning of cached options objects, and bypass of property-existence security checks. The attack requires no authentication and no user interaction over the network.

Root Cause

The root cause is an incomplete denylist in the saveMissingKeys iterator. The fix introduces hasUnsafeKeySegment(key, keySeparator), which splits the candidate key on the active keySeparator and rejects any segment matching UNSAFE_KEYS. The earlier UNSAFE_KEYS.indexOf(m) > -1 check only inspected the full literal key string.

Attack Vector

An attacker sends an HTTP POST to the route bound to missingKeyHandler with a body such as {"__proto__.polluted": "value"}. The middleware forwards the key to i18next-fs-backend, which splits on . and writes value to Object.prototype.polluted.

javascript

     }
 
     const body = options.getBody(req)
+    const keySeparator = i18next.options && i18next.options.keySeparator
 
-    // iterate only over own, non-prototype-polluting keys
+    // iterate only over own, non-prototype-polluting keys. The check also
+    // rejects dotted variants like `__proto__.polluted` whose segments under
+    // the configured keySeparator land on an unsafe key — see utils.js.
     const saveMissingKeys = src => {
       if (!src || typeof src !== 'object') return
       for (const m of Object.keys(src)) {
-        if (utils.UNSAFE_KEYS.indexOf(m) > -1) continue
+        if (utils.hasUnsafeKeySegment(m, keySeparator)) continue
         i18next.services.backendConnector.saveMissing([lng], ns, m, src[m])
       }
     }

Source: GitHub Commit 7c6d26f

The new hasUnsafeKeySegment helper applied in lib/utils.js:

javascript

+export function hasUnsafeKeySegment (key, keySeparator) {
+  if (typeof key !== 'string') return false
+  if (UNSAFE_KEYS.indexOf(key) > -1) return true
+  if (keySeparator === false) return false
+  const sep = keySeparator || '.'
+  if (key.indexOf(sep) < 0) return false
+  const segments = key.split(sep)
+  for (const s of segments) {
+    if (UNSAFE_KEYS.indexOf(s) > -1) return true
+  }
+  return false
+}

Source: GitHub Commit 7c6d26f

Detection Methods for CVE-2026-48714

Indicators of Compromise

HTTP POST or PUT request bodies containing JSON keys with __proto__, constructor, or prototype followed by a separator character (default .).
New or unexpected own properties appearing on Object.prototype at runtime, observable via heap snapshots or runtime instrumentation.
Unexplained writes to translation files managed by i18next-fs-backend containing namespace paths derived from suspicious key strings.
Application errors referencing inherited properties that should not exist on plain objects.

Detection Strategies

Inspect web application logs for request bodies posting to missingKeyHandler endpoints with keys containing the substrings __proto__, constructor, or prototype.
Run software composition analysis (SCA) to identify deployments of i18next-http-middleware below 3.9.7 and i18next-fs-backend at or below 2.6.5.
Add runtime assertions that verify Object.prototype has no enumerable own properties at startup and during health checks.

Monitoring Recommendations

Alert on 4xx and 5xx spikes from translation-related routes following requests containing __proto__ patterns.
Monitor file-system writes performed by i18next-fs-backend for unexpected output paths or namespace files.
Capture and review middleware request bodies in pre-production with body-key linting before promoting to production.

How to Mitigate CVE-2026-48714

Immediate Actions Required

Upgrade i18next-http-middleware to version 3.9.7 or later across all Node.js services.
Upgrade i18next-fs-backend to a version above 2.6.5 if used in combination with the middleware.
Audit all routes that mount missingKeyHandler and place them behind authentication or remove them from production builds.
Set saveMissing: false in i18next configuration when accepting writes from untrusted input.

Patch Information

The upstream fix is committed in 7c6d26f137d3e940b8d229ca148bca38845faf49 and shipped in i18next-http-middleware3.9.7. Full details are available in the GitHub Security Advisory GHSA-f49m-vf83-692w and the GitHub Commit Changes.

Workarounds

Do not expose missingKeyHandler to untrusted users — mount it behind authentication middleware or remove the route entirely.
Add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on the configured keySeparator.
Disable missing-key persistence by setting saveMissing: false in the i18next initialization options.
Freeze Object.prototype at application startup using Object.freeze(Object.prototype) to block runtime writes.

bash

# Upgrade the vulnerable packages
npm install i18next-http-middleware@^3.9.7
npm install i18next-fs-backend@latest

# Verify installed versions
npm ls i18next-http-middleware i18next-fs-backend