An unauthenticated prototype pollution vulnerability in the i18next-http-middleware package for Node.js allows remote attackers to compromise application integrity and potentially achieve remote code execution.

The software suffers from improper control of object prototype attributes via unvalidated entry points in getResourcesHandler and missingKeyHandler, allowing an unauthenticated HTTP client to pollute Object.prototype in the hosting Node.js process.

A successful exploit compromises the entire Node.js runtime process integrity, potentially breaking authorization checks, causing denial of service, or allowing attackers to achieve remote code execution. With a CVSS score of 8.6, this vulnerability presents a high risk to business operations, application availability, and data confidentiality.

Immediate Action: Update the npm package i18next-http-middleware to version 3.9.3 or later.

Proactive Monitoring: Monitor application logs for unusual request patterns targeting translation endpoints or unexpected property modifications within application objects.

Compensating Controls: Deploy a Web Application Firewall to inspect incoming HTTP payloads for prototype pollution attack vectors and suspicious query parameters.

Public Exploit Available: No (no confirmed public exploit or weaponized module currently exists in our curated intelligence sources).

This vulnerability carries a high severity rating due to its potential for privilege escalation and remote code execution in backend Node.js applications. Administrators must apply the version 3.9.3 update immediately to mitigate the risk of exploitation.