i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers, and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting request can leave the intended origin and cause URL injection or server-side request forgery. The default /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers,     and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom     loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an     absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting     request can leave the intended origin and cause URL injection or server-side request forgery. The default     /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because     the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
    (CVE-2026-105800)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - i18next-http-backend is a backend layer for i18next that loads translation resources in Node.js, browsers,
    and Deno. Prior to 4.0.2, attacker-controlled language or namespace values interpolated into a custom
    loadPath or addPath that begins directly with {{lng}} or {{ns}} can make colon-based input become an
    absolute URL or, in browsers, make a double-slash namespace become a protocol-relative URL. The resulting
    request can leave the intended origin and cause URL injection or server-side request forgery. The default
    /locales/{{lng}}/{{ns}}.json template and templates with a leading path or origin are not affected because
    the placeholder does not occupy the URL's structural beginning. This issue is fixed in version 4.0.2.
    (CVE-2026-105800)

ID	Name	Product	Family	Type	Severity
363680	Linux Distros Unpatched Vulnerability : CVE-2026-105800	Nessus	Misc.	Local	low
473443	SCA: security update for i18next-http-backend (GHSA-xvq9-wjp8-hwqf)	Tenable Cloud Security	SCA Checks	Local	low
473443	SCA: security update for i18next-http-backend (GHSA-xvq9-wjp8-hwqf)	Tenable Self-Hosted Container Security	SCA Checks	Local	low

Detections

Analytics

CVE-2026-105800

low

Tenable Plugins

low

low

low