---
id: GHSA-w47m-j727-m843
title: >-
  Duplicate Advisory: Namespace value starting with / forms a protocol-relative
  URL when loadPath/addPath places {{ns}} right after a / (bypass of the //
  check added for GHSA-xvq9-wjp8-hwqf)
summary: >-
  Duplicate Advisory: Namespace value starting with / forms a protocol-relative
  URL when loadPath/addPath places {{ns}} right after a / (bypass of the //
  check added for GHSA-xvq9-wjp8-hwqf)
severity: low
cvss: 3.1
cwe:
  - CWE-74
vendor: i18next-http-backend
product: i18next-http-backend
ecosystem: npm
affected:
  - i18next-http-backend <= 4.0.2
published: '2026-10-23'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T21:07:52Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-w47m-j727-m843'
references:
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
  - url: >-
      https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-xvq9-wjp8-hwqf
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-115730'
  - url: >-
      https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7
  - url: >-
      https://www.vulncheck.com/advisories/i18next-http-backend-4.0.2-protocol-relative-url-injection-via-namespace-in-interpolateurl
  - url: 'https://github.com/advisories/GHSA-w47m-j727-m843'
tags:
  - ghsa
  - npm
ingestedAt: '2026-10-28T21:18:49.942Z'
---

## Overview

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9jhj-wvmw-cfx5. This link is maintained to preserve external references.

## Original Descriptioni18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.

## Affected packages

- `i18next-http-backend <= 4.0.2`

## Remediation

Refer to the advisory for the patched release.