{"action":"Upgrade i18next-http-middleware to 3.9.3 or later.","affected":[{"fixed":"3.9.3","introduced":"0"}],"component":"i18next-http-middleware","cve_ids":["CVE-2026-42353"],"ecosystem":"npm","epss":0.00387,"exploited":false,"fixed_versions":["3.9.3"],"ghsa_id":"GHSA-jfgf-83c5-2c4m","id":"tcs_01M5KFXV39MAGGPJBD6D78X8CZ","modified_at":"2026-05-13T13:52:33.573577Z","published_at":"2026-04-29T22:26:36Z","references":["https://osv.dev/vulnerability/GHSA-jfgf-83c5-2c4m","https://github.com/i18next/i18next-http-middleware/security/advisories/GHSA-jfgf-83c5-2c4m","https://nvd.nist.gov/vuln/detail/CVE-2026-42353","https://github.com/i18next/i18next-http-middleware","https://www.i18next.com/how-to/faq#how-should-the-language-codes-be-formatted"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-jfgf-83c5-2c4m","url":"https://osv.dev/vulnerability/GHSA-jfgf-83c5-2c4m"}],"summary":"i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters"}