CVE-2026-48714

{
  "id": "CVE-2026-48714",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-15T22:16:17.550",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as \"__proto__.polluted\". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7.  If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input."
    },
    {
      "lang": "es",
      "value": "i18next-http-middleware es un middleware para ser usado con frameworks web de Node.js como express o Fastify y también para Deno. En versiones anteriores a la 3.9.7, el missingKeyHandler bloqueaba las claves literales del cuerpo de la solicitud __proto__, constructor y prototype (añadidas en la 3.9.3, ver GHSA-5fgg-jcpf-8jjw), pero no rechazaba variantes con puntos como ’__proto__.polluted’. Backends descendientes que dividen la cadena de clave faltante en un keySeparator configurado (notablemente i18next-fs-backend ? 2.6.5) entregan estas claves a un ’walker’ setPath() sin protección que escribe en Object.prototype. Las aplicaciones que exponen el missingKeyHandler a entrada no confiable Y usan i18next-fs-backend ? 2.6.5 son directamente explotables para la contaminación remota de prototipos. Otros backends descendientes que dividen la cadena de clave faltante de la misma manera pueden verse afectados de manera similar. Dependiendo de la aplicación anfitriona, las propiedades de prototipo contaminadas pueden causar fallos, comportamiento de traducción corrupto, envenenamiento de la configuración o derivaciones de comprobaciones de seguridad basadas en propiedades. Este problema ha sido solucionado en la versión 3.9.7. Si los desarrolladores no pueden actualizar inmediatamente, deben hacer lo siguiente: no exponer el missingKeyHandler a usuarios no confiables (montarlo detrás de autenticación, o eliminar la ruta), añadir un filtro de cuerpo de solicitud antes del gestor que rechace cualquier clave de nivel superior que contenga __proto__, constructor o prototype después de dividirla en su keySeparator configurado, y deshabilitar la persistencia de claves faltantes (saveMissing: false) al aceptar escrituras de entrada no confiable."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "i18next",
          "product": "i18next-http-middleware",
          "versions": [
            {
              "version": "< 3.9.7",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
          "baseScore": 9.1,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.2
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-16T14:50:19.973996Z",
          "id": "CVE-2026-48714",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1321"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:i18next:i18next-http-middleware:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "3.9.7",
              "matchCriteriaId": "F932DB43-4983-4026-A91F-ED2B9FCEC383"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49",
      "source": "[email protected]",
      "tags": [
        "Patch"
      ]
    },
    {
      "url": "https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}