CVE-2026-41690: 18next-http-middleware Prototype Pollution Hits Node.js/Deno
The National Vulnerability Database has disclosed CVE-2026-41690, a high-severity (CVSS 8.6) prototype pollution vulnerability affecting 18next-http-middleware versions prior to 3.9.3. This middleware, used in Node.js web frameworks like Express and Fastify, as well as Deno, is susceptible to unauthenticated attacks.
Attackers can exploit two unvalidated entry points — getResourcesHandler and missingKeyHandler — to pollute Object.prototype within the hosting Node.js process. This isn’t just a theoretical flaw; it directly impacts authorization checks, potentially allowing if (user.isAdmin) to return true for any user. It can also lead to type-confusion denial-of-service and, critically, may be chained into remote code execution (RCE) depending on downstream code.
This vulnerability is a prime example of how seemingly innocuous input validation flaws can cascade into critical security failures. Defenders need to recognize the severe implications of prototype pollution, especially in JavaScript environments where it can fundamentally alter object behavior across an entire application. The path to RCE or full bypass is often shorter than many realize.
What This Means For You
- If your organization uses `18next-http-middleware` with Node.js or Deno, you need to immediately audit your deployments. Prioritize patching to version 3.9.3 or later. Given the potential for unauthenticated RCE, this isn't a 'monitor and wait' scenario — it's a 'patch now' imperative. Review authentication and authorization logic in applications using this middleware for any signs of bypass.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-41690: 18next-http-middleware Prototype Pollution via getResourcesHandler
title: CVE-2026-41690: 18next-http-middleware Prototype Pollution via getResourcesHandler
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-41690 by sending a request to the getResourcesHandler endpoint with a crafted query string designed to pollute the Object.prototype. This is a direct indicator of an attempt to leverage the prototype pollution vulnerability in 18next-http-middleware.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-41690/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/locales/'
cs-uri-query|contains:
- 'lng='
cs-uri-query|contains:
- '__proto__'
cs-uri-query|contains:
- 'constructor'
cs-uri-query|contains:
- 'prototype'
condition: cs-uri AND cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-41690 | Prototype Pollution | 18next-http-middleware < 3.9.3 |
| CVE-2026-41690 | Auth Bypass | 18next-http-middleware via Object.prototype pollution |
| CVE-2026-41690 | DoS | 18next-http-middleware via type-confusion DoS |
| CVE-2026-41690 | RCE | 18next-http-middleware via chained Object.prototype pollution |
| CVE-2026-41690 | Vulnerable Component | 18next-http-middleware functions: getResourcesHandler, missingKeyHandler |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 19:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...