{"id":"GHSA-w47m-j727-m843","kind":"vulnerability","aliases":["GHSA-w47m-j727-m843"],"related":[],"title":"Duplicate Advisory: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references.\n\n## Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.","summary":"A namespace value starting with a slash can form a protocol-relative URL in loadPath or addPath templates, so translation requests go to an attacker-chosen host. An attacker who controls the namespace can then serve translations that inject UI content and cross-site scripting.","severity":"low","cvss":3.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"i18next-http-backend","fixed":[],"affected":"<= 4.0.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-74","frontend","i18next-http-backend","javascript","npm","package"],"not_affected_if":["fixed-load-path","static-namespaces"],"how_to_check":"- `npm ls i18next-http-backend` to find the installed version\n- Check whether loadPath or addPath in the i18next backend config places {{ns}} directly after a /","fix":"- Upgrade i18next-http-backend past `4.0.2` to the release that GHSA-9jhj-wvmw-cfx5 covers, as the advisory is a duplicate of it\n- unknown: the sources do not name the exact fixed version","status":"withdrawn","published_at":"2026-10-23T15:31:30+00:00","first_seen_at":"2026-10-28T21:12:46+00:00","triaged_at":"2026-10-28T21:13:41+00:00","updated_at":"2026-10-28T21:13:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T21:13:41Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade i18next-http-backend past `4.0.2` to the release that GHSA-9jhj-wvmw-cfx5 covers, as the advisory is a duplicate of it\n- unknown: the sources do not name the exact fixed version","reach":"internet","title":"i18next-http-backend: namespace value can redirect translation requests to attacker hosts","impact":"medium","summary":"A namespace value starting with a slash can form a protocol-relative URL in loadPath or addPath templates, so translation requests go to an attacker-chosen host. An attacker who controls the namespace can then serve translations that inject UI content and cross-site scripting.","category":"package","nicknames":[],"who_cares":["npm","i18next-http-backend","javascript","frontend"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker-hosted translations injected into the page, enabling cross-site scripting","analyst_note":"Withdrawn duplicate; confirm the fixed version and any exposure details at GHSA-9jhj-wvmw-cfx5 before acting on this entry.","how_to_check":"- `npm ls i18next-http-backend` to find the installed version\n- Check whether loadPath or addPath in the i18next backend config places {{ns}} directly after a /","needs_analyst":true,"not_affected_if":["static-namespaces","fixed-load-path"],"who_is_affected":"Applications that load translations with i18next-http-backend and build loadPath or addPath with {{ns}} right after a slash, and where the namespace can come from user input. Apps with static namespace names or fixed loadPath templates are not exposed. The advisory is withdrawn as a duplicate, so the active record is GHSA-9jhj-wvmw-cfx5.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000671,"input_tokens":3498,"output_tokens":642,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-74':46B '4.0.2':134C '9jhj':118C 'add':24A 'addpath':72B,172C 'advisori':2A,104C,106C 'allow':142C 'attack':81B,85B,143C,157C,177C 'attacker-chosen':80B 'attacker-host':176C 'backend':44A,51B,133C 'bypass':20A 'cfx5':120C 'check':23A 'chosen':82B 'contain':135C 'content':97B,182C 'control':87B,158C 'cross':100B,186C 'cross-sit':99B,185C 'cwe':45B 'descriptioni18next':131C 'descriptioni18next-http-backend':130C 'duplic':1A,103C,114C 'enabl':180C 'extern':127C 'fix':138C 'form':7A,63B,163C 'frontend':47B 'ghsa':27A,32A,37A,117C 'ghsa-9jhj-wvmw-cfx5':116C 'ghsa-w47m-j727-m843':31A,36A 'ghsa-xvq9-wjp8-hwqf':26A 'go':77B 'host':83B,178C 'http':43A,50B,132C 'hwqf':30A 'i18next':42A,49B 'i18next-http-backend':41A,48B 'incomplet':137C 'inject':95B,183C 'interpolateurl':140C 'j727':34A,39A 'javascript':52B 'link':122C 'load':175C 'loadpath':70B,170C 'loadpath/addpath':14A 'm843':35A,40A 'maintain':124C 'namespac':3A,56B,89B,160C 'npm':53B 'ns':16A,151C 'origin':129C 'packag':54B 'place':15A 'preserv':126C 'protocol':10A,66B,166C 'protocol-rel':9A,65B,165C 'redirect':145C 'refer':128C 'relat':11A,67B,167C 'request':76B,147C 'right':17A 'script':102B,188C 'serv':92B 'site':101B,187C 'slash':61B,156C 'start':5A,58B,153C 'suppli':149C 'templat':73B,173C 'translat':75B,93B,146C,179C 'ui':96B,181C 'url':12A,68B,168C 'valu':4A,57B,152C,161C 'w47m':33A,38A 'withdrawn':109C 'wjp8':29A 'wvmw':119C 'xvq9':28A","nicknames":[],"mitigations":[],"who_affected":"Applications that load translations with i18next-http-backend and build loadPath or addPath with {{ns}} right after a slash, and where the namespace can come from user input. Apps with static namespace names or fixed loadPath templates are not exposed. The advisory is withdrawn as a duplicate, so the active record is GHSA-9jhj-wvmw-cfx5.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T15:31:30+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-w47m-j727-m843","url":"https://github.com/advisories/GHSA-w47m-j727-m843","severity":"low","published_at":"2026-10-23T15:31:30+00:00","modified_at":"2026-10-28T21:07:52+00:00","first_seen_at":"2026-10-28T21:12:46+00:00","fetched_at":"2026-10-28T21:12:46+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}