{"action":"Upgrade i18next-http-middleware to 3.9.3 or later.","affected":[{"fixed":"3.9.3","introduced":"0"}],"component":"i18next-http-middleware","cve_ids":["CVE-2026-41690"],"ecosystem":"npm","epss":0.0031,"exploited":false,"fixed_versions":["3.9.3"],"ghsa_id":"GHSA-5fgg-jcpf-8jjw","id":"tcs_01M5KF3H06EGA4DEJ3C304097W","modified_at":"2026-05-13T13:56:02.081799Z","published_at":"2026-04-22T17:40:47Z","references":["https://osv.dev/vulnerability/GHSA-5fgg-jcpf-8jjw","https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-5fgg-jcpf-8jjw","https://nvd.nist.gov/vuln/detail/CVE-2026-41690","https://github.com/i18next/i18next-http-middleware","https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-5fgg-jcpf-8jjw","url":"https://osv.dev/vulnerability/GHSA-5fgg-jcpf-8jjw"}],"summary":"i18next-http-middleware: Prototype pollution and path traversal via user-controlled language and namespace parameters"}