CVE-2026-55451: 
JavaScript vulnerability analysis and mitigation

CVE-2026-55451 is a prototype pollution vulnerability in the js2i18next() function of the npm package gettext-converter, affecting all versions prior to 1.3.3. When processing translation data, the function splits nested keys on the default separator (##) and uses each segment as a dynamic object key without sanitization, allowing a crafted key such as __proto__##gcPolluted to write arbitrary values onto Object.prototype for the entire Node.js runtime. The vulnerability was discovered and reported by researcher Dremig on June 12, 2026, with the GitHub Advisory published on August 20, 2026. It carries a CVSS v4 base score of 6.9 (Medium) (GitHub Advisory, Security Advisory).

The root cause is classified as CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). In lib/js2i18next.js, the converter splits translation keys on the ## separator and iterates over each segment to build a nested output object using appendTo[keys[x]] = appendTo[keys[x]] || {}. When a segment equals __proto__, JavaScript resolves appendTo["__proto__"] to Object.prototype, and the subsequent Object.assign(appendTo, newValues) writes the translated value directly onto Object.prototype, polluting it for the entire runtime. The attack requires no authentication or special privileges — an attacker only needs to supply malicious translation data (PO or i18next JS objects) to an application that passes untrusted input to js2i18next(). A minimal proof-of-concept was included in the original bug report (GitHub Issue #15, Patch Commit).

Successful exploitation pollutes Object.prototype for the entire Node.js runtime, meaning every object in the application inherits the attacker-controlled property. The primary confirmed impact is denial of service, as unexpected properties on Object.prototype can break application logic, cause type errors, or crash services. Depending on how the application uses the polluted properties, further attacks such as privilege escalation, authentication bypass, or remote code execution may be possible in certain application contexts. Confidentiality and integrity of the vulnerable system are not directly impacted in the base case, but the availability of the application is degraded (GitHub Advisory).

No public exploit kit or weaponized exploit has been reported for CVE-2026-55451, though a clear proof-of-concept was included in the original GitHub issue report, making exploitation straightforward for any attacker who can supply translation data to a vulnerable application. The CVE status remains "Reserved" and there is no evidence of in-the-wild exploitation or threat actor attribution at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No EPSS score is currently available (GitHub Issue #15, GitHub Advisory).

1. Identify a target application: Find a Node.js application that uses the gettext-converter npm package (version < 1.3.3) and passes user-controlled or externally sourced translation data to the js2i18next() function.
2. Craft a malicious translation key: Construct a translation object containing a key with __proto__ as a ##-separated segment, for example: "__proto__##gcPolluted" with a desired payload as the translated value.
3. Deliver the payload: Supply the crafted translation data to the application through any available input vector — such as a file upload endpoint accepting PO/i18next files, an API accepting translation JSON, or any other mechanism that feeds data into js2i18next().
4. Trigger prototype pollution: When js2i18next() processes the malicious key, it splits on ##, resolves appendTo["__proto__"] to Object.prototype, and writes the payload value onto it via Object.assign().
5. Achieve impact: The polluted Object.prototype property is now inherited by all objects in the runtime. Depending on the application, this can cause denial of service (crashes, logic errors) or enable further exploitation such as property injection into security-sensitive code paths (GitHub Issue #15, Patch Commit).

• Logs: Unexpected JavaScript errors or type errors in application logs referencing properties that should not exist on plain objects; Node.js crash logs or unhandled exception traces following translation file processing.
• File System: Presence of translation files (.po, .json) containing keys with segments __proto__, constructor, or prototype separated by ## (e.g., __proto__##anyProperty).
• Process Behavior: Unusual application behavior or crashes immediately after processing externally supplied translation data; unexpected properties appearing on {} (empty object literals) during runtime debugging.

Upgrade gettext-converter to version 1.3.3 or later, which rejects any translation key segment equal to __proto__, constructor, or prototype before using it as a dynamic object key (GitHub Release v1.3.3). If an immediate upgrade is not possible, sanitize and validate all translation keys before passing them to js2i18next(), explicitly rejecting any key whose ##-separated segments include __proto__, constructor, or prototype. Applications should also restrict the sources of translation data to trusted, controlled inputs to reduce the attack surface (GitHub Advisory).

The vulnerability was reported by researcher Dremig directly to the locize/gettext-converter repository via GitHub Issue #15 on June 12, 2026, and the maintainer (adrai) responded promptly with a patch released the same day. The advisory was formally published to the GitHub Advisory Database on August 20, 2026. No significant broader media coverage or notable community commentary beyond the original report and patch has been identified (GitHub Issue #15, Security Advisory).