An unauthenticated path traversal and server-side request forgery vulnerability in i18next-http-middleware allows remote attackers to access sensitive files or force arbitrary network requests via unvalidated input parameters.

This vulnerability involves improper limitation of a pathname to a restricted directory and server-side request forgery, triggered when unauthenticated attackers supply unsanitized language and namespace values through getResourcesHandler.

A successful exploit can lead to unauthorized access to internal file systems or malicious interactions with internal network resources, posing significant risks of data exfiltration and architectural compromise. The high CVSS score of 8.2 reflects the severity of allowing remote, unauthenticated access to sensitive system layers.

Immediate Action: Update the i18next-http-middleware package to version 3.9.3 or later.

Proactive Monitoring: Review application access logs for unusual requests containing path traversal patterns or unexpected outbound connection attempts originating from the application server.

Compensating Controls: Deploy a Web Application Firewall to inspect and block HTTP requests containing malicious path manipulation sequences or suspicious parameters.

Public Exploit Available: No (no confirmed public exploit or proof-of-concept is currently available in the tracking data).

Security teams must prioritize updating the i18next-http-middleware package to the patched version across all affected Node.js and Deno applications immediately. Implementing this update removes the vulnerability and secures the underlying infrastructure against potential data disclosure and forgery vectors.