i18next-http-backend

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

View on npm

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

i18next-http-backend is a backend layer for i18next using in Node.js, in the browser and for Deno.

Latest release4.0.7

Declared licenseMIT

Listed maintainersadrai, jamuhl

Runtime dependencies0

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationNot marked deprecated

Fetched 31/10/2026, 09:13:34 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

low3.7

CVE-2026-118258Fix available

i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string

npm / i18next-http-backend

3 days ago

i18next-http-backend npm

Affected range	Recorded fix
Earlier releases before 4.0.4Semantic versions	4.0.4

Version evidence: OSV · GHSA-3cmx-xjww-583x

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.0.4"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

low3.1

GHSA-9jhj-wvmw-cfx5Fix available

i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)

npm / i18next-http-backend

8 days ago

i18next-http-backend npm

Affected range	Recorded fix
Earlier releases before 4.0.3Semantic versions	4.0.3

Version evidence: OSV · GHSA-9jhj-wvmw-cfx5

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "4.0.3"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}