{"action":"Upgrade i18next-http-middleware to 3.9.3 or later.","affected":[{"fixed":"3.9.3","introduced":"0"}],"component":"i18next-http-middleware","cve_ids":["CVE-2026-41683"],"ecosystem":"npm","epss":0.00327,"exploited":false,"fixed_versions":["3.9.3"],"ghsa_id":"GHSA-c3h8-g69v-pjrg","id":"tcs_01M5KFHKAQ5Q8CZ4ZMMK6PSNRW","modified_at":"2026-05-13T13:52:05.255318Z","published_at":"2026-04-22T20:25:49Z","references":["https://osv.dev/vulnerability/GHSA-c3h8-g69v-pjrg","https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-c3h8-g69v-pjrg","https://nvd.nist.gov/vuln/detail/CVE-2026-41683","https://github.com/i18next/i18next-http-middleware/commit/65301c194593d46a84623b64e5fde2f51d3550f6","https://github.com/i18next/i18next-http-middleware"],"severity":{"label":"high","score":8.6},"sources":[{"source":"osv","source_id":"GHSA-c3h8-g69v-pjrg","url":"https://osv.dev/vulnerability/GHSA-c3h8-g69v-pjrg"}],"summary":"i18next-http-middleware: HTTP response splitting and DoS via unsanitised Content-Language header"}