UBUNTU-CVE-2026-118258

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2026-118258

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-118258.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2026-118258

Upstream

CVE-2026-118258

Published

2026-10-29T00:00:00Z

Modified

2026-10-29T20:04:30Z

Severity

3.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.4, interpolateUrl inserts unencoded language and namespace values into loadPath or addPath templates without rejecting ampersand (&), equals (=), or semicolon (;) query separators. When a template places lng or ns in the query string and an attacker controls that value, the attacker can add or override parameters on browser or server-side translation requests, potentially exposing other namespaces or tenants or changing backend behavior through the application's network position and credentials. This vulnerability is the result of an incomplete fix for CVE-2026-41691. This issue is fixed in version 4.0.4.

References

Affected packages

Ubuntu:22.04:LTS / node-i18next-http-backend

Package

Name: node-i18next-http-backend
Purl: pkg:deb/ubuntu/node-i18next-http-backend?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.21+dfsg-1

1.3.1+dfsg-2

1.3.1+dfsg-3

1.3.1+dfsg-4

1.3.2+dfsg-1

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "libjs-i18next-http-backend",
            "binary_version":  "1.3.2+dfsg-1"
        },
        {
            "binary_name":  "node-i18next-http-backend",
            "binary_version":  "1.3.2+dfsg-1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-118258.json"

Ubuntu:24.04:LTS / node-i18next-http-backend

Package

Name: node-i18next-http-backend
Purl: pkg:deb/ubuntu/node-i18next-http-backend?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.1.1-1

2.4.1+ds-2

2.4.1+ds-2build2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "libjs-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        },
        {
            "binary_name":  "node-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-118258.json"

Ubuntu:26.10 / node-i18next-http-backend

Package

Name: node-i18next-http-backend
Purl: pkg:deb/ubuntu/node-i18next-http-backend?arch=source&distro=stonking

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.1+ds-2build2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "libjs-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        },
        {
            "binary_name":  "node-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-118258.json"

Ubuntu:26.04:LTS / node-i18next-http-backend

Package

Name: node-i18next-http-backend
Purl: pkg:deb/ubuntu/node-i18next-http-backend?arch=source&distro=resolute

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.4.1+ds-2build2

Ecosystem specific

{
    "binaries":  [
        {
            "binary_name":  "libjs-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        },
        {
            "binary_name":  "node-i18next-http-backend",
            "binary_version":  "2.4.1+ds-2build2"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-118258.json"