CVE-2026-48714Critical· 9.1▾ Midnighti18next-http-middleware: MissingKeyHandler does not reject keys whose segments contain prototype-polluting names
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 50.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.4%
0.4% → 0.7%
i18next-http-middleware ≤ 3.9.6's missingKeyHandler blocked the literal request-body keys __proto__, constructor, and prototype (added in 3.9.3, see GHSA-5fgg-jcpf-8jjw), but did not reject dotted variants such as "__proto__.polluted". Downstream backends that split the missing-key string on a configured keySeparator (notably i18next-fs-backend ≤ 2.6.5) hand these keys to an unguarded setPath() walker that writes to Object.prototype.
Applications that expose missingKeyHandler to untrusted input AND use i18next-fs-backend ≤ 2.6.5 are directly exploitable for remote prototype pollution. Other downstream backends that split the missing-key string the same way may be similarly affected.
Depending on the host application, polluted prototype properties may cause crashes, corrupted translation behaviour, configuration poisoning, or bypasses of property-based security checks.
Fixed in i18next-http-middleware 3.9.7. A new utils.hasUnsafeKeySegment(key, keySeparator) helper is now used by missingKeyHandler; the configured i18next.options.keySeparator is honoured (default .; false disables segment splitting and only the literal-key denylist applies). Legitimate dotted keys (e.g. "header.title") are unaffected.
The root-cause fix has been shipped in i18next-fs-backend 2.6.6 — see the companion advisory.
If users cannot upgrade immediately:
missingKeyHandler to untrusted users (mount it behind authentication, or remove the route).__proto__, constructor, or prototype after splitting on a configured keySeparator.saveMissing: false) when accepting writes from untrusted input.i18next-fs-backend: GHSA-2933-q333-qg83.i18next-http-middleware security release: GHSA-5fgg-jcpf-8jjw and GHSA-c3h8-g69v-pjrg (in 3.9.3).i18next-http-middleware < 3.9.7Upgrade to a patched release:
i18next-http-middleware 3.9.7Connected by shared product, vendor, weakness, or advisory.
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
CVE-2026-118249High· 7.2Highcharts: series column construction writes to Object.prototype
CVE-2026-118250High· 7.2Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-116674Medium· 6.5systeminformation has prototype pollution in `networkStats()` via the interface name
CVE-2026-114604HighGraphQL Tools: Prototype pollution in mergeIncrementalResult via non-primitive path segments