[Pkg-javascript-devel] Bug#1150648: node-i18next-http-backend: CVE-2026-41691

[Salvatore Bonaccorso]

Source: node-i18next-http-backend
Version: 2.4.1+ds-2
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security upstream

Hi,

The following vulnerability was published for node-i18next-http-backend.

CVE-2026-41691[0]:
| Copilot said: i18nextify is a JavaScript library that adds
| i18nextify is a JavaScript library that adds website
| internationalization via a script tag, without source code changes.
| Versions prior to 3.0.5 interpolate the lng and ns values directly
| into the configured loadPath / addPath URL template without any
| encoding, validation, or path sanitisation. When an application
| exposes the language-code selection to user-controlled input (the
| default — i18next-browser-languagedetector reads ?lng= query params,
| cookies, localStorage, and request headers), an attacker can inject
| characters that change the structure of the outgoing request URL.
| This is a single URL-injection vulnerability. The attacker-
| controlled value is neutralised before it is used as part of an
| output URL string; the attack shape covers both path traversal and
| broader URL-structure injection — both are closed by the one
| interpolateUrl sanitisation fix. This issue has been fixed in
| version 3.0.5. If users cannot upgrade immediately, they can work
| around the issue by sanitising lng / ns before they reach i18next
| (strip .., /, \, ?, #, %, whitespace, and control characters; cap
| the length).

Note, the fix needs to be made complete to not open CVE-2026-105800,
which exists due to an incomplete fix for CVE-2026-41691.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-41691
    https://www.cve.org/CVERecord?id=CVE-2026-41691
[1] https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-q89c-q3h5-w34g
[2] https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore