CVE-2026-115730

Low

Description

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

SeverityLow

CVSS3.1

Exploit probability—

ProductI18next-http-backend

PublishedOct 23, 2026

First seenOct 23, 2026

Weakness typeCWE-74Injection

How to fix

Update

i18next-http-backend4.0.3 or later

Patches

github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7

Vendor advisories

Affected products

Product	Affected versions	Fixed in
i18next-http-backendnpm	v < 4.0.3	4.0.3

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.