---
id: CVE-2026-115730
title: >-
  i18next-http-backend 4.0.2 Protocol-Relative URL Injection via Namespace in
  interpolateUrl
summary: >-
  i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that
  allows attackers to redirect translation requests by supplying an ns value
  starting with a slash. Attackers controlling the namespace value can form a
  protoco…
severity: low
cvss: 3.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-74
  - CWE-79
vendor: i18next
product: i18next-http-backend
affected:
  - i18next-http-backend >= 4.0.2 < 4.0.3
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T13:17:52.877008Z'
exploitAvailable: true
published: '2026-10-23'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:19:15.108Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-115730'
references:
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
    label: GitHub Security Advisory (GHSA-9jhj-wvmw-cfx5)
  - url: >-
      https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
    label: GitHub Security Advisory (GHSA-xvq9-wjp8-hwqf)
  - url: >-
      https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl
    label: >-
      VulnCheck Advisory: i18next-http-backend 4.0.2 Protocol-Relative URL
      Injection via Namespace in interpolateUrl
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115730'
  - url: 'https://github.com/advisories/GHSA-9jhj-wvmw-cfx5'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-115730'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2559717'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-115730'
tags:
  - cve.org
  - exploit-available
  - ghsa
  - npm
  - csaf
  - vex
  - red-hat
aliases:
  - GHSA-9jhj-wvmw-cfx5
ecosystem: npm
patched:
  - i18next-http-backend 4.0.3
epss: 0.00318
epssPercentile: 0.24913
ingestedAt: '2026-10-23T13:24:55.508Z'
---

## Overview

i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

## Affected

- `i18next-http-backend >= 4.0.2 < 4.0.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-115730)

Affected packages:

- `i18next-http-backend < 4.0.3`

Patched in:

- `i18next-http-backend 4.0.3`

Source: https://github.com/advisories/GHSA-9jhj-wvmw-cfx5

## Vendor advisories

- **Red Hat VEX** · Low · affected: Migration Toolkit for Applications 8, Multicluster Engine for Kubernetes, Network Observability Operator, OpenShift Service Mesh 3, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat AMQ Broker 7, … · no fix planned: OpenShift Service Mesh 3, Red Hat Ansible Automation Platform 2, Red Hat Edge Manager 1, Migration Toolkit for Applications 8, … · updated 2026-10-23 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-115730.json)