CVE-2026-41683 - Vulnerability Analysis

Overview

i18next-http-middleware < 3.9.3 contains a CRLF injection caused by improper sanitization of user-controlled language values in the Content-Language header, letting attackers inject carriage return and line feed characters, exploit requires use of older i18next versions producing raw language values.

Severity & Score

Impact

Attackers can inject HTTP headers or manipulate responses, potentially enabling HTTP response splitting or web cache poisoning.

Mitigation

Update to version 3.9.3 or later.

References

• https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner