CVE-2026-41693: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41693 is a path traversal vulnerability in i18next-fs-backend, a Node.js/Deno filesystem backend for the i18next internationalization library. Versions prior to 2.6.4 substitute the lng (language) and ns (namespace) options directly into configured loadPath/addPath templates without encoding or validation, enabling attackers who can influence these values to read or overwrite arbitrary files on the host filesystem. The vulnerability was published on May 8, 2026, and patched in version 2.6.4. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-22 (Path Traversal) and CWE-73 (External Control of File Name or Path). The i18next-fs-backend library interpolates user-supplied lng and ns values directly into filesystem path templates (loadPath/addPath) without sanitization, allowing sequences such as ../../../../etc/passwd to escape the intended locale directory. Exploitation is trivially achievable via a single HTTP request (e.g., ?lng=../../../../etc/passwd) when lng/ns are derived from untrusted input — such as query strings, cookies, or headers — through middleware like i18next-http-middleware. The attack requires no authentication, no special privileges, and no user interaction. The patch in v2.6.4 introduces an interpolatePath sanitization layer with an isSafeIdentifier helper that rejects values containing .., path separators (/, \), control characters, prototype keys (__proto__, constructor, prototype), empty strings, and values exceeding 128 characters (GitHub Advisory).

Successful exploitation enables arbitrary file read on the host filesystem — any file readable by the Node.js process (source code, configuration files, SSH keys, .env files, Docker secrets, /etc/passwd, etc.) becomes accessible to an unauthenticated remote attacker. If saveMissing is enabled, the vulnerability also permits arbitrary file overwrite via the addPath (save-missing) code path, allowing an attacker to corrupt files or plant attacker-controlled JSON content at arbitrary filesystem locations, potentially affecting other processes that later read those files. The severity is bounded only by the filesystem privileges of the Node.js process, and denial of service via extreme path lengths is also possible (GitHub Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time. The EPSS score is approximately 0.04%, reflecting low current exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Despite the lack of active exploitation, the attack is trivially simple — requiring only a crafted HTTP query parameter — making it a high-priority patching target for any application exposing lng/ns to user input (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify web applications using i18next-fs-backend versions prior to 2.6.4 with i18next-http-middleware or similar HTTP middleware that exposes language selection via query string, cookie, or HTTP header (e.g., Accept-Language).
2. Identify the input vector: Determine how the application accepts the lng or ns parameter — commonly via ?lng= query string, a i18next cookie, or a custom header.
3. Craft a path traversal payload: Construct a lng value containing directory traversal sequences, e.g., ../../../../etc/passwd (adjust depth based on the configured loadPath template).
4. Send the malicious request: Issue an HTTP GET request such as GET /api/translations?lng=../../../../etc/passwd to the target application.
5. Retrieve file contents: The backend attempts to read the resolved path from disk and may return the file contents in the HTTP response (e.g., as a translation resource), exposing sensitive file data.
6. File overwrite (if saveMissing enabled): If the application has saveMissing: true configured, send a POST/PUT request with a crafted lng/ns value targeting a writable path (e.g., a cron file or config file) to write attacker-controlled JSON content to that location (GitHub Advisory).

• Network: HTTP requests containing path traversal sequences (../, ..%2F, ..%5C) in lng or ns query parameters, cookies, or headers targeting i18next-enabled endpoints.
• Logs: Application/web server access logs showing requests like GET /...?lng=../../../../etc/passwd or similar encoded variants; error log entries from Node.js referencing unexpected filesystem paths outside the locale directory.
• File System: Unexpected or modified files in locations outside the configured locale/translation directory, particularly if saveMissing is enabled; new or altered JSON files in sensitive directories (e.g., /etc/, application config directories).
• Process: Node.js process attempting to open file descriptors for paths outside the expected locale directory (detectable via strace, auditd, or eBPF-based monitoring tools).

Upgrade i18next-fs-backend to version 2.6.4 or later, which introduces the interpolatePath sanitization layer that validates all lng/ns values before filesystem access. If immediate upgrading is not possible, implement input validation at the application boundary: reject any lng/ns values containing .., /, \, %, whitespace, control characters, or strings exceeding 128 characters before passing them to i18next. Additionally, restrict the Node.js process's filesystem permissions using the principle of least privilege to limit the blast radius of any file read or overwrite. The advisory notes there is no complete workaround short of upgrading (GitHub Advisory).

The vulnerability was discovered via an internal security audit of the i18next ecosystem and disclosed by the project maintainer (adrai) through a GitHub Security Advisory on April 18, 2026. A Bluesky post from a CVE tracking account noted the disclosure shortly after publication. Coverage has appeared on security aggregator sites including infinitsec.net and The Hacker Wire, though no major vendor statements or notable independent researcher commentary beyond the official advisory have been identified (GitHub Advisory).