CVE-2026-48713: i18next-fs-backend: Prototype pollution via crafted missing-key string

Synopsis

Prototype pollution is a JavaScript-specific vulnerability affecting i18next-fs-backend, a file-system translation backend for the i18next internationalization library. The flaw is reachable over the network with no authentication required: an attacker sends a crafted missing-key string (for example, "__proto__.polluted") to any endpoint that forwards untrusted input to i18next with saveMissing enabled, causing the library's key-path walker to write arbitrary properties onto Object.prototype, the shared ancestor of all JavaScript objects in the process. Successful exploitation lets an attacker corrupt application state, poison configuration objects, crash the service, or bypass property-based access controls. No fix version has been published yet; HarborGuard is tracking the upstream advisory and will make a patched-image rebuild available as soon as a fix is released.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the vulnerable missing-key handler over the network; any publicly or internally routable HTTP endpoint that forwards untrusted input to i18next with saveMissing enabled is exposed.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, meaning any unauthenticated party who can send an HTTP request to the endpoint can trigger the vulnerability.

• Victim interactionNot required

  No user interaction is required; the attacker sends a crafted request directly to the service without any action from a legitimate user.

• Attack complexityDetail

  Attack complexity is Low (AC:L), meaning the exploit is reliable and condition-free: no race conditions, memory-layout dependencies, or special environmental states are required.

Blast Radius

• An attacker writes arbitrary properties onto Object.prototype, poisoning the shared prototype chain for every JavaScript object in the running process.
• Polluted prototype properties can override configuration values read by downstream application code, enabling configuration poisoning that affects unrelated subsystems.
• Property-based security checks (for example, permission flags read from object properties) can be bypassed if the expected property is shadowed by a polluted prototype value.
• The process can be crashed outright if a polluted prototype key conflicts with an internal property accessed during normal request handling, producing a Denial of Service.