CVE-2026-41691 is a medium severity URL injection flaw (CVSS 6.5) in i18next-http-backend before 3.0.5. Language and namespace values go into the load path URL without encoding, so a user controlled language code can change the request. Upgrade to 3.0.5.
What's affected
The GitHub advisory lists the npm package i18next-http-backend before 3.0.5, with 3.0.5 patched. The NVD description text mentions i18nextify, but the advisory and references concern i18next-http-backend, so check both names in your lockfiles.
The advisory says the exposure arises when the application lets user controlled input pick the language, which is the default behavior with the i18next browser language detector that reads query parameters, cookies, local storage and request headers.
How to check if you're exposed
npm ls i18next-http-backend
pnpm why i18next-http-backend
Check your i18next setup for a loadPath or addPath with lng and ns placeholders, and see how the language is picked. If the language comes from a fixed allowlist, risk is lower. If it comes from a query string or cookie, it is attacker influenced.
What to do now
- Upgrade
i18next-http-backendto 3.0.5 or later. - Restrict the language and namespace values to a fixed allowlist in your own code, which is good practice regardless.
- For server side rendering that reads locale files through a file path, review the load path closely, since the advisory notes broader effects there.
- Add a dependency gate to pull requests so outdated packages are flagged early.
Why it matters
The record lists CWE-22, path traversal, and CWE-74, injection. The helper that fills in the URL template returned raw values, while the query string helper already encoded them. Characters such as slashes, question marks and hash signs could change which resource is requested.
On a plain web fetch the effect is limited to requesting a different URL, though the advisory notes that when a file based scheme is used on the server side, it could read files from the host. It is a good case for allowlisting inputs at the edge. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is the NVD text about the wrong package?
The description mentions i18nextify, but the advisory is for i18next-http-backend. Treat the advisory as the source for the fix.
Sources
Last reviewed: 19 October 2026.
