{"action":"Upgrade i18next-http-middleware to 3.9.7 or later.","affected":[{"fixed":"3.9.7","introduced":"0"}],"component":"i18next-http-middleware","cve_ids":["CVE-2026-48714"],"ecosystem":"npm","epss":0.00507,"exploited":false,"fixed_versions":["3.9.7"],"ghsa_id":"GHSA-f49m-vf83-692w","id":"tcs_01M5KFMES9TEXJXW4VSZ110HZ3","modified_at":"2026-06-25T17:56:29.524803Z","published_at":"2026-06-25T17:28:12Z","references":["https://osv.dev/vulnerability/GHSA-f49m-vf83-692w","https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-f49m-vf83-692w","https://nvd.nist.gov/vuln/detail/CVE-2026-48714","https://github.com/i18next/i18next-http-middleware/commit/7c6d26f137d3e940b8d229ca148bca38845faf49","https://github.com/i18next/i18next-http-middleware"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-f49m-vf83-692w","url":"https://osv.dev/vulnerability/GHSA-f49m-vf83-692w"}],"summary":"i18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names"}