CVE-2026-115730

Name	CVE-2026-115730
Description	i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation requests by supplying an ns value starting with a slash. Attackers controlling the namespace value can form a protocol-relative URL in loadPath or addPath templates to load attacker-hosted translations, enabling UI content injection and cross-site scripting.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
node-i18next-http-backend (PTS)	bookworm	2.1.1-1	fixed
	forky, sid, trixie	2.4.1+ds-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
node-i18next-http-backend	source	(unstable)	(not affected)

Notes

- node-i18next-http-backend <not-affected> (Incomplete fix for CVE-2026-41691 and CVE-2026-105800 not applied)
https://github.com/i18next/i18next-http-backend/security/advisories/GHSA-9jhj-wvmw-cfx5
Fixed by: https://github.com/i18next/i18next-http-backend/commit/042c3d4e4e9d73b2ae3aa76b22cb45d48f1e35b7 (v4.0.3)