Bug 2546630 (CVE-2026-105800)
| Summary: | CVE-2026-105800 i18next-http-backend: i18next-http-backend: Server-Side Request Forgery via crafted path template parameters | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | akhatavk, aos-team-art-private, asdas, ataylor, csuconic, dbruscin, dpaolell, dschmidt, ehugonne, gparvin, gtully, ikhan, jbalunas, jdelft, jlanda, jsherman, jupierce, jwong, kshier, kvanderr, lgarciaa, mbiarnes, omaciel, pjindal, ppalepu, ppostler, prdhamdh, rbobbitt, rgemmell, rgodfrey, rhaigner, rjohnson, sghai, sidsharm, simaishi, stcannon, suppawar, tbish, tlavocat, tsze, ttakamiy, vlaad, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in i18next-http-backend. A remote attacker can supply crafted language or namespace values to applications configured with custom translation path templates that begin directly with placeholders. This manipulation causes the application to generate unintended external web addresses, potentially leading to Server-Side Request Forgery (SSRF, where the server is coerced into making unauthorized network requests) or redirecting browser requests to external destinations.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.