CVE-2026-63402: 
JavaScript vulnerability analysis and mitigation

CVE-2026-63402 is a prototype pollution vulnerability in i18next, a widely used JavaScript internationalization framework, that allows an attacker to corrupt shared built-in function objects process-wide, resulting in denial of service and limited integrity impact. The flaw exists in the deepExtend function within src/utils.js in all versions prior to 26.3.4. It was disclosed on June 30, 2026 via a GitHub Security Advisory and assigned a CVSS v3.1 base score of 5.9 (Medium) (GitHub Advisory, Feedly).

The root cause is classified under CWE-471 (Modification of Assumed-Immutable Data) and CWE-1321 (Improperly Controlled Modification of Object Prototype Attributes). The deepExtend function used the JavaScript in operator to check property existence, which walks the prototype chain and causes recursion into inherited built-in objects on Object.prototype (e.g., hasOwnProperty, toString, valueOf). When addResourceBundle(lng, ns, data, deep, overwrite) is called with deep: true and overwrite: true and attacker-controlled data, a payload such as { hasOwnProperty: { call: 'corrupted' } } causes the function to recurse into Object.prototype.hasOwnProperty and overwrite its call property with a non-callable value, corrupting it process-wide. The existing __proto__/constructor guard does not prevent this because the corruption target is an inherited built-in function, not the prototype object itself (GitHub Advisory, Fix Commit).

Successful exploitation causes an unrecoverable, process-wide denial of service: once a shared built-in such as Object.prototype.hasOwnProperty.call is overwritten with a non-callable value, all subsequent calls to it — including i18next internals — throw TypeError, crashing the application. There is also a limited integrity impact, as an attacker-supplied value is written to a shared built-in property accessible across the entire Node.js process. Confidentiality is not impacted. The blast radius is confined to the affected process, but in server-side Node.js applications this can take down the entire service (GitHub Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires that an attacker control data passed to addResourceBundle with both deep: true and overwrite: true — a non-default configuration not used by any standard i18next backend or integration — significantly limiting the attack surface (GitHub Advisory, Feedly).

1. Identify vulnerable application: Locate a Node.js or browser-based application using i18next version ≤ 26.3.3 that exposes an endpoint or interface allowing user-controlled data to be passed to addResourceBundle with deep: true and overwrite: true.
2. Craft malicious payload: Construct a JSON object with a key matching an inherited built-in function name, such as { "hasOwnProperty": { "call": "corrupted" } }.
3. Submit payload: Deliver the crafted object as the data argument to addResourceBundle('en', 'translation', payload, true, true) — for example, via an API endpoint, user-supplied translation bundle, or any application code path that merges untrusted content into i18next resources.
4. Trigger corruption: The deepExtend function recurses into Object.prototype.hasOwnProperty (found via the in operator) and, with overwrite: true, sets an own call property on that built-in to the string 'corrupted'.
5. Achieve DoS: Any subsequent call to Object.prototype.hasOwnProperty.call(...) — including i18next internals — throws TypeError: ... is not a function, causing an unrecoverable process-wide crash (GitHub Advisory).

• Logs: Repeated TypeError: Object.prototype.hasOwnProperty.call is not a function or similar errors in application logs or Node.js crash reports, particularly originating from i18next internals.
• Application Behavior: Sudden, unrecoverable application crashes or process exits following calls to translation resource loading or bundle updates.
• Input Data: Presence of keys such as hasOwnProperty, toString, or valueOf as top-level keys in translation resource bundles or API payloads submitted to i18next resource endpoints.
• Process: Node.js process terminating unexpectedly with uncaught TypeError stack traces referencing deepExtend in i18next/src/utils.js (GitHub Advisory).

Upgrade i18next to version 26.3.4 or later, which fixes the issue by replacing the in operator with Object.prototype.hasOwnProperty.call(target, prop) in deepExtend, ensuring only own properties trigger recursion (Fix Commit, GitHub Advisory). As a workaround for applications that cannot immediately upgrade, avoid passing attacker-controlled data to addResourceBundle with both deep: true and overwrite: true; setting either flag to false (or omitting them) eliminates the vulnerable code path. No standard i18next backend or integration uses this configuration by default, so most deployments are unaffected without any changes.

The vulnerability was responsibly disclosed by a researcher credited as "manus-use" in the GitHub Security Advisory, with thanks also noted to "zx (Jace)" in the changelog (GitHub Advisory, Fix Commit). The i18next maintainer (adrai) promptly published the advisory and patch. No significant broader media coverage or notable community controversy has been observed, consistent with the vulnerability's medium severity and narrow exploitation preconditions.