An unauthenticated HTTP response splitting vulnerability in i18next-http-middleware prior to version 3.9.3 allows attackers to manipulate HTTP headers via crafted language parameters.

This vulnerability involves improper neutralization of CRLF sequences in HTTP headers and cross-site scripting risks, affecting the language parameter processed by unauthenticated users through the middleware.

A successful exploit could allow attackers to conduct cross-site scripting attacks, poison web caches, or hijack user sessions by injecting arbitrary HTTP headers. Based on a CVSS score of 8.6, this vulnerability represents a high severity risk that could lead to significant data compromise and integrity violations in affected Node.js applications.

Immediate Action: Update the i18next-http-middleware package to version 3.9.3 or later where the CRLF injection issue is resolved.

Proactive Monitoring: Monitor application logs for unusual HTTP requests containing carriage return or line feed characters within language parameters or URL query strings.

Compensating Controls: Deploy a Web Application Firewall to inspect and block incoming HTTP requests containing CRLF sequences in sensitive parameters.

Public Exploit Available: No (no confirmed public exploit or proof-of-concept exists in the available data).

Given the high CVSS score of 8.6 and the potential for header manipulation attacks, administrators should prioritize updating the i18next-http-middleware package immediately. Applying the official fix in version 3.9.3 will effectively neutralize the injection vector and secure web applications against response splitting.