8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41683

CVE-2026-41683: HTTP response splitting and DoS in i18next-http-middleware via unsanitised Content-Language header

i18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Prior to version 3.9.3, i18next-http-middleware wrote user-controlled language values into the Content-Language response header after passing them through utils.escape(), which is an HTML-entity encoder that does not strip carriage return, line feed, or other control characters. When the application used an older i18next (< 19.5.0) that still exercised the backward-compatibility fallback at LanguageDetector.js:100 or otherwise produced a raw detected value, CRLF sequences in the attacker-controlled lng parameter reached res.setHeader('Content-Language', ...) verbatim. This issue has been patched in version 3.9.3.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41683

CVE-2026-41683:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
i18next-http-middleware	npm	< 3.9.3	3.9.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the security advisory and the associated commit 65301c194593d46a84623b64e5fde2f51d3550f6 reveals two primary vulnerabilities in the i18next-http-middleware package, both stemming from improper input sanitization of the user-provided language parameter (lng).

HTTP Response Splitting / DoS in handle(): The core of the vulnerability lies in the handle function in lib/index.js. This function used utils.escape() on the lng parameter before setting it as the Content-Language HTTP header. The escape function only performed HTML-entity encoding and failed to strip control characters like CR (\r) and LF (\n). This allowed attackers to inject raw CRLF sequences into the response headers. On Node.js versions before 14.6.0, this led to HTTP response splitting, enabling attacks like session fixation and cache poisoning. On newer Node.js versions, this would cause an ERR_INVALID_CHAR exception that, being unhandled by the middleware, would crash the process and cause a Denial of Service. The fix was to replace utils.escape() with a new utils.sanitizeHeaderValue() function that explicitly removes these control characters.
XSS Filter Bypass in hasXSS(): A related but distinct vulnerability was fixed in the hasXSS utility function in lib/utils.js. This function's regex for detecting event handlers was too specific, only matching handlers that appeared as the first attribute in an HTML tag. This allowed for a simple bypass. An attacker could craft a malicious language parameter that would pass the hasXSS check but still contain an executable XSS payload. If the application then rendered this language parameter on a page without proper escaping, it would lead to reflected XSS. The patch strengthens the regex to catch event handlers anywhere within a tag.

Both vulnerable functions, handle and hasXSS, would appear in a runtime profile during an exploit, as they are directly involved in processing the malicious input.

Vulnerable functions

handle

lib/index.js

The `handle` function is the main middleware entry point. It was vulnerable to HTTP response splitting and Denial of Service. The function took a user-controlled language parameter (`lng`) and set it in the 'Content-Language' response header. The sanitization function used, `utils.escape()`, did not remove Carriage Return (CR) and Line Feed (LF) characters. This allowed an attacker to inject CRLF sequences into the header, leading to response splitting on older Node.js versions or a server crash due to an unhandled exception on newer versions. The patch replaces the inadequate `utils.escape()` call with `utils.sanitizeHeaderValue()`, which properly strips control characters.

hasXSS

lib/utils.js

The `hasXSS` utility function was intended to filter out cross-site scripting payloads from language identifier strings. However, the regular expression used was flawed and could be bypassed. It only checked for HTML event handlers (like `onfocus`) if they were the first attribute in a tag. An attacker could bypass this check by placing another attribute before the event handler (e.g., `<input autofocus onfocus=alert(1)>`). If an application rendered this user-supplied language string without proper output encoding, it would be vulnerable to reflected XSS. The patch corrects the regex to detect event handlers regardless of their position within the tag.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.