Prototype Pollution in i18next JavaScript Framework

Publication date: 2026-10-30

Last updated on: 2026-10-30

Assigner: GitHub, Inc.

Description

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-30

Last Modified

2026-10-30

Generated

2026-10-31

AI Q&A

2026-10-31

EPSS Evaluated

N/A

NVD

CVE-2026-63402

Affected Vendors & Products

Vendor	Product	Version / Range
i18next	i18next	< 26.3.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-471	The product does not properly protect an assumed-immutable element from being modified by an attacker.
CWE-1321	The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

Executive Summary

This vulnerability exists in i18next, a JavaScript internationalization framework, prior to version 26.3.4. The issue is in the deepExtend function which uses the in operator to check property existence and recurses into inherited built-ins via Object.prototype. Attackers can exploit this by passing malicious data to addResourceBundle with deep and overwrite set to true, allowing them to modify shared inherited function objects like hasOwnProperty or toString. This can cause TypeError exceptions, leading to denial of service and limited integrity impact.

Impact Analysis

If exploited, this vulnerability can cause your application to crash due to TypeError exceptions when using i18next functions. It may also allow attackers to manipulate certain built-in JavaScript functions, potentially disrupting application behavior. However, default configurations without deep merging or overwrite enabled are not affected.

Mitigation Strategies

Upgrade i18next to version 26.3.4 or later to address the vulnerability in deepExtend function.

Hi! I’m here to help you understand CVE-2026-63402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70