Home / Vulnerability Intelligence / CVE-2026-42353

CVE-2026-42353 - Vulnerability Analysis

HighCVSS: 8.2

Last Updated: May 8, 2026

i18next-http-middleware - Path Traversal & Server Side Request Forgery

Published: May 8, 2026Updated: May 8, 2026Remote Exploitable

Overview

i18next-http-middleware < 3.9.3 contains a path traversal and SSRF vulnerability caused by unsanitized user-controlled lng and ns values in getResourcesHandler, letting remote attackers access arbitrary paths or trigger SSRF, exploit requires crafted requests.

Severity & Score

Severity: High

CVSS Score: 8.2

Impact

Remote attackers can perform path traversal or SSRF, potentially accessing sensitive files or internal services.

Mitigation

Upgrade to version 3.9.3 or later.

References

https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m

Related Resources

Details

CVE ID: CVE-2026-42353
Severity: High
CVSS Score: 8.2
Type: path_traversal
Status: new

CWE

CWE-22

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N