Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthenticated HTTP client to pollute Object.prototype in the Node.js process hosting the middleware, via two unvalidated entry points that reach internal object-key writes: getResourcesHandler and missingKeyHandler. This can break authorisation checks (if (user.isAdmin) returning true for any user), cause type-confusion DoS, and depending on downstream code it can be chained into RCE.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-41690 Prototype Pollution in i18next-http-middleware Before 3.9.3 Enables Unauthenticated Attacks https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-41690
Post summary
The post highlights that i18next-http-middleware versions below 3.9.3 suffer from prototype‑pollution leading to potential unauthenticated attacks, but provides no evidence of active exploitation or a PoC, and does not mention fixes.
CVE-2026-41690 18next-http-middleware is a middleware to be used with Node.js web frameworks like express or Fastify and also for Deno. Versions prior to 3.9.3 allow an unauthentica… https://www.cve.org/CVERecord?id=CVE-2026-41690
Post summary
The text presents a disclosure of CVE‑2026‑41690, noting vulnerable 18next‑http‑middleware versions before 3.9.3, without providing PoC, exploit, or mitigation details.