CVE-2026-42353: 
JavaScript vulnerability analysis and mitigation

CVE-2026-42353 is a path traversal and Server-Side Request Forgery (SSRF) vulnerability in the i18next-http-middleware npm package affecting all versions prior to 3.9.3. The flaw allows unauthenticated remote attackers to read arbitrary files from the server filesystem or redirect server-side HTTP requests to internal services by supplying malicious lng and ns query parameters. It was discovered via an internal security audit of the i18next ecosystem, published by maintainer adrai on April 22, 2026, and added to the GitHub Advisory Database on April 29, 2026. It carries a CVSS v3.1 base score of 8.2 (High) (GitHub Advisory, i18next Advisory).

The root cause is missing input sanitization (CWE-22: Path Traversal; CWE-918: SSRF) in the getResourcesHandler function, which passes user-supplied lng and ns query parameters directly to i18next.services.backendConnector.load(languages, namespaces, …) without any validation. When the middleware is paired with i18next-fs-backend, these unsanitized values are interpolated into filesystem paths, enabling directory traversal (e.g., GET /locales/resources.json?lng=../../etc/passwd&ns=root). When paired with i18next-http-backend, the same values are interpolated into outgoing HTTP URLs, enabling SSRF to internal services or cloud metadata endpoints. An additional side effect is unbounded growth of the i18next.options.ns singleton array, which can be abused for memory exhaustion via repeated unique namespace payloads (GitHub Advisory, i18next Advisory).

Exploitation can result in arbitrary file reads — any file accessible to the Node.js process (source code, .env files, SSH keys, Docker secrets, configuration files) becomes retrievable by an unauthenticated attacker. When SSRF is triggered via an HTTP backend, attackers can reach internal services and cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), potentially escalating to credential theft and lateral movement within internal networks. A secondary availability impact exists through memory exhaustion by flooding the server with unique namespace values (GitHub Advisory).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the time of disclosure (GitHub Advisory). The vulnerability requires no authentication, no user interaction, and is exploitable over the network with low attack complexity, making it trivially exploitable once an attacker identifies a vulnerable deployment. The EPSS score is approximately 0.052% (6th percentile), indicating a currently low but non-negligible probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify Node.js web applications using i18next-http-middleware versions prior to 3.9.3 by inspecting HTTP response headers, JavaScript bundle contents, or package manifests (e.g., package.json exposed via misconfiguration).
2. Identify the resources endpoint: Locate the locale resources endpoint, typically at /locales/resources.json or a similar path configured by the middleware's getResourcesHandler.
3. Determine the backend type: Probe the application to infer whether it uses i18next-fs-backend (filesystem) or i18next-http-backend (HTTP) by observing response content and error messages.
4. Path traversal attack (fs-backend): Send a crafted GET request with path traversal sequences in the lng parameter, e.g., GET /locales/resources.json?lng=../../etc/passwd&ns=root. The server will read and return the targeted file's contents.
5. SSRF attack (http-backend): Craft a request where lng or ns reshapes the outgoing backend URL to target an internal service, e.g., GET /locales/resources.json?lng=169.254.169.254/latest/meta-data/iam/security-credentials/&ns=role to access cloud metadata credentials.
6. Memory exhaustion (optional): Send repeated requests with unique ns values to grow the i18next.options.ns singleton array, potentially causing denial of service through memory exhaustion (GitHub Advisory, i18next Advisory).

• Network: Unusual GET requests to locale resource endpoints (e.g., /locales/resources.json) with lng or ns parameters containing .., /, \, or URL-like structures; outbound HTTP requests from the Node.js server to internal IP ranges (RFC 1918) or cloud metadata addresses (e.g., 169.254.169.254).
• Logs: Web server/application access logs showing requests with encoded path traversal sequences (%2e%2e, %2f) or absolute paths in lng/ns query parameters; repeated requests with large numbers of unique ns values suggesting memory exhaustion attempts.
• Process/Runtime: Elevated Node.js memory consumption due to unbounded growth of the i18next.options.ns array; unexpected file read operations on sensitive paths (/etc/passwd, .env, .ssh/) by the Node.js process.
• File System: Evidence of sensitive file access in OS-level audit logs (e.g., auditd records) for files like /etc/passwd, application .env, or SSH private keys accessed by the Node.js process user.

The primary remediation is to upgrade i18next-http-middleware to version 3.9.3 or later, which introduces utils.isSafeIdentifier to filter lng and ns values before they reach the backend connector, rejecting .. sequences, path separators, control characters, prototype pollution keys, empty strings, and values exceeding 128 characters (GitHub Advisory). As a defense-in-depth measure, also upgrade i18next-fs-backend to ≥ 2.6.4 and i18next-http-backend to ≥ 3.0.5, which apply equivalent sanitization at the backend layer. If immediate upgrade is not possible, deploy a WAF rule to reject requests where lng or ns parameters contain .., /, \, or URL-structure characters as a partial mitigation. Network segmentation limiting the Node.js server's outbound HTTP access can reduce SSRF impact.

The vulnerability was noted on Mastodon via The Hacker Wire shortly after NVD publication, and was indexed by multiple vulnerability tracking services including CVEFeed, CVE.report, and Vulners (Feedly). No significant vendor statements beyond the maintainer's own advisory, nor notable independent researcher commentary, have been identified at this time.