CVE-2026-42353: i18next-http-middleware Path Traversal and SSRF Risk
The National Vulnerability Database has detailed CVE-2026-42353, a high-severity vulnerability (CVSS 8.2) affecting i18next-http-middleware, a popular Node.js and Deno middleware used in frameworks like Express and Fastify. Prior to version 3.9.3, this middleware fails to properly sanitize user-controlled lng and ns values before passing them directly into i18next.services.backendConnector.load(). This oversight is critical.
Depending on the backend configuration, this flaw enables attackers to exploit either path traversal (CWE-22) or Server-Side Request Forgery (SSRF) (CWE-918). Path traversal allows unauthorized access to arbitrary files on the server, potentially exposing sensitive data or configuration files. SSRF, on the other hand, can be leveraged to force the server to make requests to internal or external systems, bypassing firewalls and accessing internal services or data.
The implications for defenders are clear: unvalidated input is a perennial attack vector. This specific vulnerability allows an attacker to dictate resource paths or initiate arbitrary network requests from the server’s context. Organizations using i18next-http-middleware must prioritize patching to version 3.9.3 or later to mitigate these significant risks. Failure to do so leaves a wide-open door for data exfiltration or internal network reconnaissance.
What This Means For You
- If your Node.js or Deno applications utilize `i18next-http-middleware`, you are exposed to high-severity path traversal and SSRF. Immediately verify your `i18next-http-middleware` version and patch to 3.9.3 or higher. Audit your application logs for any suspicious `lng` or `ns` parameter values, especially those containing `../` or internal IP addresses.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-42353: i18next-http-middleware Path Traversal in URI Query
title: CVE-2026-42353: i18next-http-middleware Path Traversal in URI Query
id: scw-2026-05-08-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-42353 by looking for the 'lng' and 'ns' parameters in the URI query string, combined with path traversal sequences like '../'. This indicates an attempt to leverage the unescaped path segments in i18next-http-middleware to access unauthorized files or resources.
author: SCW Feed Engine (AI-generated)
date: 2026-05-08
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-42353/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri-query|contains:
- '?lng='
- '&ns='
cs-uri-query|contains:
- '../'
condition: cs-uri-query
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-42353 | Vulnerability | CVE-2026-42353 |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 08, 2026 at 19:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate
CVE-2026-6667 — PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration console...
CVE-2026-6666 — A possible null pointer reference in PgBouncer before
CVE-2026-6666 — A possible null pointer reference in PgBouncer before 1.25.2 could lead to a crash, if a server sends an error response without SQLSTATE...
PgBouncer SCRAM Vulnerability (CVE-2026-6665) Allows Stack Overflow
CVE-2026-6665 — The SCRAM code in PgBouncer before 1.25.2 did not check the return value of strlcat() correctly when building the contents of the SCRAM...