External risk intelligence

i18nextify URL Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-41691

The vulnerability exists in a client-side JavaScript library designed for website internationalization. Since this library is commonly integrated into public-facing web applications to handle user language preferences via query parameters and other input mechanisms, it is inherently exposed to the public internet as part of the standard web application surface.

Path Traversal

I18next Http Backend

before 3.0.5

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in a JavaScript library used for website internationalization. The flaw allows for URL injection, potentially enabling attackers to manipulate outgoing request URLs by exploiting how language and namespace values are processed. The main concern is to confirm if this technology is in use and assess potential exposure.

Website internationalization library has a URL injection flaw.
Affects how user language settings are processed.
Confirm relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can inject malicious characters into a website's language selection mechanism. This allows them to manipulate the URLs the application requests to load internationalization data, potentially leading to unauthorized access or data modification.

Accessible via network.
User input alters URL structure.
High impact on confidentiality and integrity.

Live Threat

Current exploitation, exposure, and threat context

When an application uses i18nextify to manage website language, user-controlled input for language selection could allow an attacker to manipulate outgoing request URLs. This could affect the application's ability to load language translation files.

Website language files could be compromised.
URL injection through language parameters.
Application could load unintended resources.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Application Owner is primarily responsible for addressing this vulnerability, as it resides within a JavaScript library integrated into web applications. The first practical step is to identify all instances of the `i18nextify` library across your web presence, confirm their exposure to user-controlled input, and assess their criticality. Once accountable owners are identified, remediation should be planned based on the assessed risk.

Identify accountable application owners.
Verify external exposure and impact.
Plan coordinated updates or mitigations.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is i18nextify and how is it used?

i18nextify is a JavaScript library designed to handle website internationalization. Developers integrate it into websites to automatically manage translation loading via a simple script tag, which avoids the need for complex source code changes. It simplifies how sites display content in different languages by fetching language-specific files dynamically as users browse.

How does CVE-2026-41691 cause URL injection?

This vulnerability, classified as Improper Neutralization of Input (CWE-74) and Path Traversal (CWE-22), occurs because the library fails to sanitize language or namespace settings. When these values are inserted directly into a URL template, an attacker can input special characters to alter the request structure. This allows them to trick the application into connecting to unauthorized paths or unintended network locations.

When does this vulnerability trigger?

The flaw triggers when the library processes user-controlled input—such as query parameters, cookies, or headers—as a language code without validation. It does not trigger if the application only uses hardcoded language values that cannot be influenced by user input. If your configuration does not allow users to affect the language-detection mechanism, the attack vector is effectively neutralized.

Is my website at risk according to Halo Surface Signal?

Halo Surface Signal identifies this as a 'Likely' risk because i18nextify is commonly used in public-facing web applications. Since these applications often read language preferences directly from the public internet via browser inputs, the library’s design inherently places it on the external web surface, making it accessible to external actors by default.

How do I secure my application against this bug?

The most effective step is to update the i18nextify library to version 3.0.5 or newer, which includes the necessary sanitization logic. If you cannot update immediately, you must implement custom input filtering to strip sensitive characters like slashes, dots, and control characters from all language and namespace inputs before they are passed to the library.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.