Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

This vulnerability affects versions of i18next-http-middleware prior to 2.6.6 and is a prototype pollution issue. It occurs when crafted missing-key strings are used to persist missing translation keys. The backend.writeFile() function splits these keys on a configured separator and then calls an internal function that does not properly guard against unsafe segments. This allows an attacker to inject keys like "__proto__.polluted" which modifies the global Object prototype. As a result, arbitrary properties can be written onto the global object prototype.

Useful 0 Not Useful 0

Impact Analysis

The impact of this vulnerability depends on the host application. Polluted prototype properties can cause application crashes, corrupted translation behavior, configuration poisoning, or bypasses of property-based security checks. Applications are only affected if the missingKeyHandler or similar routes that accept untrusted input and save missing keys are exposed to untrusted users and the default key splitting behavior is enabled.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability immediately, you should take the following precautions if you cannot upgrade to version 2.6.6:

• Do not expose i18next-http-middleware's missingKeyHandler to untrusted users; mount it behind authentication or remove the route.
• Disable missing-key persistence by setting saveMissing to false or by not implementing backend.create when accepting writes from untrusted input.
• Set keySeparator to false in your i18next options to disable backend key splitting, noting that this also disables nested translation keys.

Useful 0 Not Useful 0