CVE-2026-48714
Publiée le 2026-06-15 · Dernière modification le 2026-10-25
Les applications Node.js utilisant `i18next-http-middleware` et `i18next-fs-backend` sont vulnérables à une pollution de prototype à distance. Un attaquant non authentifié peut envoyer une requête réseau spécialement conçue pour injecter des propriétés dans des objets JavaScript globaux, ce qui peut entraîner des plantages de l'application, la corruption de données ou le contournement de contrôles de sécurité. Cette exploitation est facile à exécuter et ne nécessite aucune interaction de l'utilisateur ni d'authentification préalable.
DÉTAIL DU VECTEUR CVSS
RÉFÉRENCES
Description officielle du NVD (en anglais)
i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. In versions prior to 3.9.7, the missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype. Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected. Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks. This issue has been fixed in version 3.9.7. If developers cannot upgrade immediately, they should do the following: do not expose missingKeyHandler to untrusted users (mount it behind authentication, or remove the route), add a request-body filter ahead of the handler that rejects any top-level key containing __proto__, constructor, or prototype after splitting on their configured keySeparator, and disable missing-key persistence (saveMissing: false) when accepting writes from untrusted input.