i18next i18next-http-backend
4 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-118258 | < 4.0.4 | i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string | LOW 3.7 | 0.3 % | ||
| CVE-2026-115730 | 4.0.2 – < 4.0.3 | i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in interpolateUrl | LOW 2.3 | 0.3 % | ||
| CVE-2026-105800 | < 4.0.2 | i18next-http-backend incomplete URL validation permits SSRF | LOW 3.7 | 0.3 % | ||
| CVE-2026-41691 | < 3.0.5 | i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns | CRITICAL 9.1 | 0.3 % |