Loading story…
Two critical prototype pollution vulnerabilities, CVE-2026-48713 and CVE-2026-48714, were disclosed in the widely used Node.js internationalization components i18next-fs-backend and i18next-http-middleware. The bugs allow attacker-controlled missing translation keys to traverse unsafe path segments such as __proto__, constructor, and prototype, potentially writing arbitrary properties into Object.prototype. In affected deployments, successful exploitation can trigger application crashes, corrupt translation behavior, poison configuration, and bypass property-based security checks.
The primary backend flaw affects i18next-fs-backend versions before 2.6.6, while the middleware flaw affects i18next-http-middleware versions before 3.9.7 and can help remote input reach the vulnerable backend path by failing to block dotted payloads such as __proto__.polluted. Exploitation depends on applications exposing missingKeyHandler or similar saveMissing functionality to untrusted users with key splitting enabled. Maintainers patched the issues by blocking unsafe path traversal, and defenders are advised to upgrade immediately, restrict missing-key routes to trusted users, disable missing-key persistence for untrusted input, or set keySeparator to false where appropriate.
See affected versions and whether adversaries are exploiting it.
4 events from the most recent confirmed update back to the earliest known activity.
CVE-2026-48714 was disclosed as a critical prototype pollution vulnerability in i18next-http-middleware affecting versions before 3.9.7. The issue stems from missingKeyHandler rejecting literal unsafe keys but not dotted variants that can reach vulnerable backends.
CVE-2026-48713 was disclosed as a critical prototype pollution vulnerability in i18next-fs-backend affecting versions before 2.6.6. The flaw allows crafted missing-key strings from untrusted input to write arbitrary properties to Object.prototype under certain configurations.
Maintainers fixed CVE-2026-48714 in i18next-http-middleware version 3.9.7. The fix addressed missingKeyHandler failing to reject dotted prototype-polluting key variants such as "__proto__.polluted".
Maintainers fixed CVE-2026-48713 in i18next-fs-backend version 2.6.6 by blocking unsafe path traversal through prototype-polluting segments such as __proto__, constructor, and prototype.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors began actively exploiting **React2Shell** (`CVE-2025-55182`), a critical issue affecting *Next.js* and **React Server Components** that can enable **unauthenticated remote code execution** on vulnerable, internet-facing servers. Reporting describes exploitation starting within ~20 hours of public disclosure, with attacks observed as malicious HTTP `POST` requests targeting routes such as `/_next/server` and `/_next/flight`, abusing server-component serialization to inject commands into the application runtime. WhoisXMLAPI attributed a large share of scanning/exploitation activity to the **“ILOVEPOOP”** toolkit, which used centralized infrastructure (noted as high-traffic nodes hosted in the Netherlands), rotating scanner nodes, and a distinctive request fingerprint including non-standard headers like `X-Nextjs-Request-Id: poop1234` and `Next-Action: x`. Separately, two additional JavaScript supply-chain/library vulnerabilities were disclosed that can be triggered via attacker-controlled input in Node.js applications. *Axios* is affected by a high-severity **denial-of-service** flaw (`CVE-2026-25639`, CVSS 7.5) in `mergeConfig`, where a configuration object containing an own `__proto__` property can cause a `TypeError` and crash the Node.js process when user input is parsed (e.g., via `JSON.parse()`) and passed into Axios configuration. CERT/CC also published **VU#458422** for a **prototype pollution** vulnerability in *CASL Ability* (versions 2.4.0–6.7.4) in `rulesToFields()` / `setByPath()` (extra module), where insufficient sanitization of path segments allows writing to `Object.prototype` via special keys (e.g., `prototype`, `constructor`, and `_proto_`), potentially enabling broad application compromise up to **arbitrary code execution** depending on how polluted properties are later used.
Jun 29, 2026
A critical vulnerability in the Axios HTTP client library, tracked as **`CVE-2026-40175`**, allows attackers to turn polluted JavaScript object properties into malicious HTTP headers and abuse outbound requests for **SSRF**, **request smuggling**, and potential **remote code execution**. Researchers said the flaw stems from improper header handling in Axios’s HTTP adapter and unsafe config merging, which can let `Object.prototype` values containing CRLF characters be injected into requests. The issue can be chained with prototype pollution in other npm packages to target internal services, including the AWS EC2 metadata endpoint at `169.254.169.254`, potentially bypassing **IMDSv2** and exposing cloud credentials or broader infrastructure. A public proof-of-concept was released alongside disclosure, raising urgency for defenders even though active exploitation had not been confirmed at the time of reporting. The flaw affects Axios versions before **`1.13.2`**, while maintainers said **`1.15.0`** introduces strict header validation that blocks CRLF-based header injection; organizations were urged to upgrade and audit dependencies such as **`body-parser`**, **`qs`**, and **`minimist`** for prototype pollution paths. One report cited internet-wide estimates of more than **48,000** potentially exposed instances, underscoring the risk of unauthorized internal access and possible full cloud compromise.
Jun 29, 2026
A high-severity flaw in the Axios HTTP client, tracked as **`CVE-2026-67320`**, can cause Node.js applications to send requests through an attacker-controlled proxy when the Node HTTP adapter is used and **prototype pollution** has already compromised `Object.prototype`. The issue stems from request configuration hardening being undone by common interceptor patterns such as object spreading or `Object.assign`, allowing a polluted `proxy` property to be inherited through the prototype chain. Affected versions are **`0.31.1` through `0.32.9`** and **`1.15.2` through `1.17.9`**, with fixes released in **`0.33.0`** and **`1.18.0`**. Successful exploitation can expose plaintext HTTP traffic, including **Authorization headers**, Basic auth credentials from `config.auth`, request methods, full URLs, `Host` headers, and request bodies, while also enabling attackers to return manipulated responses to the application. Italian authorities reported that a **proof-of-concept exploit is now publicly available**, increasing the urgency for organizations using vulnerable Axios versions in Node.js environments to patch promptly. The advisory notes there is no demonstrated browser impact and no HTTPS header or body disclosure under normal TLS validation.
Aug 3, 2026