CVE-2026-55451: gettext-converter Prototype Pollution DoS

CVE-2026-55451 Overview

CVE-2026-55451 is a prototype pollution vulnerability [CWE-1321] in the gettext-converter JavaScript library, which provides gettext resource conversion utilities. Versions prior to 1.3.3 are affected. The flaw resides in js2i18next() inside lib/js2i18next.js, where nested translation keys are split using options.keyseparator and each segment is used as a dynamic object key without filtering __proto__, constructor, or prototype. When an application converts untrusted PO or i18next translation data, a __proto__ segment resolves to Object.prototype, allowing Object.assign to write attacker-controlled values onto the process-wide prototype.

Critical Impact
Prototype pollution can cause application-wide denial of service and enable follow-on attacks whose severity depends on downstream code paths that consume polluted properties.

Affected Products

gettext-converter npm package versions prior to 1.3.3
JavaScript applications converting untrusted PO files via js2i18next()
JavaScript applications converting untrusted i18next translation JSON

Discovery Timeline

2026-09-14 - CVE-2026-55451 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-55451

Vulnerability Analysis

The gettext-converter library converts between gettext PO format and i18next JSON. Its js2i18next() function builds nested output objects by splitting incoming keys on options.keyseparator, whose default value is two number signs (##). Each split segment is then used as a dynamic property name on the target object, and Object.assign merges the translation value into that target.

Because the segment list is not filtered against dangerous property names, a translation key containing __proto__ walks into Object.prototype. Any subsequent write applies to every object in the runtime that inherits from Object.prototype. The result is a process-wide state change from untrusted input.

Downstream impact depends on the host application. Common consequences include denial of service through corrupted control flow, altered configuration lookups, and gadget-driven code execution when polluted properties reach sensitive sinks such as template engines or child-process spawning.

Root Cause

The root cause is missing validation of dynamic object keys derived from user-controlled input. The vulnerable code does not maintain a deny-list for __proto__, constructor, or prototype, and does not use a null-prototype object (Object.create(null)) as the write target. This matches the classic pattern captured by CWE-1321: Improperly Controlled Modification of Object Prototype Attributes.

Attack Vector

An attacker supplies a crafted PO or i18next JSON document to any application that passes such data through js2i18next(). The document contains a translation key such as __proto__##polluted (using the default keyseparator). During conversion, the parser resolves __proto__ as the nested write target and assigns the attacker's value onto Object.prototype.polluted. Every object in the process now inherits polluted, and any code performing untyped property checks on unrelated objects observes the injected value.

javascript

// Patch excerpt from lib/js2i18next.js (v1.3.3)
// inspired by https://github.com/i18next/i18next-gettext-converter/blob/master/src/lib/gettext2json.js
import { getPlurals } from './options.js'
import { UNSAFE_KEYS } from './shared.js'
import cldrConv from './cldrConv.js'

const FORMS = ['zero', 'one', 'two', 'few', 'many', 'other']

const isFuzzy = (translation) => !!translation.comments && translation.comments.flag === 'fuzzy'

const isUnsafeKey = (key) => UNSAFE_KEYS.indexOf(key) > -1

Source: GitHub commit df90c3b. The patch introduces a shared UNSAFE_KEYS deny-list and an isUnsafeKey guard used before assigning nested keys.

Detection Methods for CVE-2026-55451

Indicators of Compromise

Translation source files (.po, .json) containing key segments __proto__, constructor, or prototype
Unexpected properties appearing on plain objects at runtime that were never explicitly set
Application errors originating from iteration over object keys shortly after processing user-supplied translation data
Presence of gettext-converter versions earlier than 1.3.3 in package-lock.json or yarn.lock

Detection Strategies

Perform software composition analysis on Node.js dependency manifests to flag gettext-converter < 1.3.3.
Add pre-ingest linting on PO and i18next JSON that rejects keys matching /(^|##)(__proto__|constructor|prototype)(##|$)/.
Instrument runtime with a boot-time snapshot of Object.prototype own-property names and alert on additions.
Review commit history and CI logs for imports of js2i18next that receive network- or upload-sourced content.

Monitoring Recommendations

Log and alert on translation-conversion errors and unexpected TypeError exceptions in i18n code paths.
Monitor process memory and event-loop lag for anomalies after translation file uploads, which can indicate DoS pollution.
Capture and retain uploaded PO files in a quarantine tier for post-incident inspection.

How to Mitigate CVE-2026-55451

Immediate Actions Required

Upgrade gettext-converter to version 1.3.3 or later across all Node.js projects and container images.
Rebuild and redeploy applications after upgrading to ensure the patched module is loaded in every runtime.
Audit application code for other callers that build nested objects from untrusted keys and apply the same deny-list pattern.
Rotate any secrets or tokens that may have been exposed through polluted configuration lookups on affected hosts.

Patch Information

The fix is available in gettext-converterv1.3.3. Technical details are documented in GHSA-f4jp-rw7w-ccwg and the issue discussion. The patched code introduces a shared UNSAFE_KEYS list and rejects any key segment matching __proto__, constructor, or prototype before assignment.

Workarounds

Sanitize PO and i18next inputs before calling js2i18next() by stripping keys containing __proto__, constructor, or prototype.
Freeze Object.prototype at application startup with Object.freeze(Object.prototype) to block runtime writes.
Restrict translation ingestion to trusted, authenticated sources until the upgrade is deployed.

bash

# Upgrade the vulnerable dependency
npm install gettext-converter@1.3.3
# or
yarn upgrade gettext-converter@1.3.3

# Verify no vulnerable versions remain in the dependency tree
npm ls gettext-converter