CVE-2026-48714

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-48714", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-22T18:47:27.755Z", "datePublished": "2026-06-15T20:41:49.382Z", "dateUpdated": "2026-06-16T14:50:29.087Z"}, "containers": {"cna": {"title": "i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w"}, {"name": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49", "tags": ["x_refsource_MISC"], "url": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49"}], "affected": [{"vendor": "i18next", "product": "i18next-http-middleware", "versions": [{"version": "< 3.9.7", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-15T20:41:49.382Z"}, "descriptions": [{"lang": "en", "value": "i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend \u2264 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend \u2264 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input."}], "source": {"advisory": "GHSA-f49m-vf83-692w", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-16T14:50:19.973996Z", "id": "CVE-2026-48714", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:50:29.087Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-48714", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-16T14:50:19.973996Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-16T14:50:25.454Z"}}], "cna": {"title": "i18next-http-middleware missingKeyHandler does not reject keys whose segments contain prototype-polluting names", "source": {"advisory": "GHSA-f49m-vf83-692w", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "i18next", "product": "i18next-http-middleware", "versions": [{"status": "affected", "version": "< 3.9.7"}]}], "references": [{"url": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w", "name": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49", "name": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend \u2264 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend \u2264 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1321", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-06-15T20:41:49.382Z"}}}, "cveMetadata": {"cveId": "CVE-2026-48714", "state": "PUBLISHED", "dateUpdated": "2026-06-16T14:50:29.087Z", "dateReserved": "2026-05-22T18:47:27.755Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-06-15T20:41:49.382Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "i18next-http-middleware", "vendor": "i18next", "versions": [{"status": "affected", "version": "< 3.9.7"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:i18next:i18next-http-middleware:*:*:*:*:*:node.js:*:*", "matchCriteriaId": "F932DB43-4983-4026-A91F-ED2B9FCEC383", "versionEndExcluding": "3.9.7", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend \u2264 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend \u2264 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input."}, {"lang": "es", "value": "i18next-http-middleware es un middleware para ser usado con frameworks web de Node.js como express o Fastify y tambi\u00e9n para Deno. En versiones anteriores a la 3.9.7, el missingKeyHandler bloqueaba las claves literales del cuerpo de la solicitud __proto__, constructor y prototype (a\u00f1adidas en la 3.9.3, ver GHSA-5fgg-jcpf-8jjw), pero no rechazaba variantes con puntos como \u2019__proto__.polluted\u2019. Backends descendientes que dividen la cadena de clave faltante en un keySeparator configurado (notablemente i18next-fs-backend ? 2.6.5) entregan estas claves a un \u2019walker\u2019 setPath() sin protecci\u00f3n que escribe en Object.prototype. Las aplicaciones que exponen el missingKeyHandler a entrada no confiable Y usan i18next-fs-backend ? 2.6.5 son directamente explotables para la contaminaci\u00f3n remota de prototipos. Otros backends descendientes que dividen la cadena de clave faltante de la misma manera pueden verse afectados de manera similar. Dependiendo de la aplicaci\u00f3n anfitriona, las propiedades de prototipo contaminadas pueden causar fallos, comportamiento de traducci\u00f3n corrupto, envenenamiento de la configuraci\u00f3n o derivaciones de comprobaciones de seguridad basadas en propiedades. Este problema ha sido solucionado en la versi\u00f3n 3.9.7. Si los desarrolladores no pueden actualizar inmediatamente, deben hacer lo siguiente: no exponer el missingKeyHandler a usuarios no confiables (montarlo detr\u00e1s de autenticaci\u00f3n, o eliminar la ruta), a\u00f1adir un filtro de cuerpo de solicitud antes del gestor que rechace cualquier clave de nivel superior que contenga __proto__, constructor o prototype despu\u00e9s de dividirla en su keySeparator configurado, y deshabilitar la persistencia de claves faltantes (saveMissing: false) al aceptar escrituras de entrada no confiable."}], "id": "CVE-2026-48714", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-48714", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-16T14:50:19.973996Z", "version": "2.0.3"}}]}, "published": "2026-06-15T22:16:17.550", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49"}, {"source": "security-advisories@github.com", "tags": ["Mitigation", "Vendor Advisory"], "url": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.9.7)"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 85.0, "source": "matching"}]}, "original": {"product": "i18next-http-middleware", "source": "cna", "vendor": "i18next"}, "product": "i18next-http-middleware", "vendor": "i18next"}], "created": "2026-06-16T13:45:16.285691+00:00", "updated": "2026-06-17T23:00:14.712989+00:00", "vendors": ["i18next", "i18next$PRODUCT$i18next-http-middleware"]}