{"id":"CVE-2026-115730","kind":"vulnerability","aliases":["CVE-2026-115730"],"related":[],"title":"i18next-http-backend: namespace slash redirects translation loads to attacker hosts","description":"i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","summary":"i18next-http-backend 4.0.2 has an incomplete fix in interpolateUrl(): a namespace value starting with a slash turns the translation URL into a protocol-relative URL. An attacker who controls the namespace can load translations from an attacker-hosted server, which can inject UI content and cross-site scripting.","severity":"low","cvss":3.1,"epss":0.00356,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","i18next","javascript","node","package"],"not_affected_if":["no-user-input-in-loadpath","static-namespaces"],"how_to_check":"- Check the installed version with `npm ls i18next-http-backend`\n- Look for `loadPath` or `addPath` templates that interpolate a user-controlled namespace value","fix":null,"status":"open","published_at":"2026-10-23T13:17:08+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:47:19+00:00","updated_at":"2026-10-25T12:38:50+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:47:19Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"i18next-http-backend: namespace slash redirects translation loads to attacker hosts","impact":"medium","summary":"i18next-http-backend 4.0.2 has an incomplete fix in interpolateUrl(): a namespace value starting with a slash turns the translation URL into a protocol-relative URL. An attacker who controls the namespace can load translations from an attacker-hosted server, which can inject UI content and cross-site scripting.","category":"package","nicknames":[],"who_cares":["javascript","frontend","i18next","node"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-hosted translations inject UI content and run cross-site scripting","analyst_note":"Check the NVD entry and the upstream i18next-http-backend advisory for the fixed version and whether a user-controlled namespace is required.","how_to_check":"- Check the installed version with `npm ls i18next-http-backend`\n- Look for `loadPath` or `addPath` templates that interpolate a user-controlled namespace value","needs_analyst":true,"not_affected_if":["static-namespaces","no-user-input-in-loadpath"],"who_is_affected":"Applications that use i18next-http-backend 4.0.2 and build translation URLs from a namespace value that a user can influence. Apps with fixed namespace names or no user input in the translation path are unlikely to be exposed.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000598,"input_tokens":3348,"output_tokens":526,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-115730':15A,18A '-2026':14A,17A '4.0.2':28B,81C 'addpath':119C 'allow':89C 'attack':11A,53B,64B,90C,104C,124C 'attacker-host':63B,123C 'backend':4A,27B,80C 'contain':82C 'content':71B,129C 'control':55B,105C 'cross':74B,133C 'cross-sit':73B,132C 'cve':13A,16A 'enabl':127C 'fix':32B,85C 'form':110C 'frontend':19B 'host':12A,65B,125C 'http':3A,26B,79C 'i18next':2A,20B,25B,78C 'i18next-http-backend':1A,24B,77C 'incomplet':31B,84C 'inject':69B,130C 'interpolateurl':34B,87C 'javascript':21B 'load':9A,59B,122C 'loadpath':117C 'namespac':5A,36B,57B,107C 'node':22B 'ns':98C 'packag':23B 'protocol':49B,113C 'protocol-rel':48B,112C 'redirect':7A,92C 'relat':50B,114C 'request':94C 'script':76B,135C 'server':66B 'site':75B,134C 'slash':6A,41B,103C 'start':38B,100C 'suppli':96C 'templat':120C 'translat':8A,44B,60B,93C,126C 'turn':42B 'ui':70B,128C 'url':45B,51B,115C 'valu':37B,99C,108C","nicknames":[],"mitigations":[],"who_affected":"Applications that use i18next-http-backend 4.0.2 and build translation URLs from a namespace value that a user can influence. Apps with fixed namespace names or no user input in the translation path are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115730","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115730","severity":null,"published_at":"2026-10-23T13:17:08+00:00","modified_at":"2026-10-23T19:45:03+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-115730","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-115730","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:50+00:00","fetched_at":"2026-10-25T12:38:50+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}