SB20261110339 - Uncaught Exception in i18next-fs-backend

Description

This security bulletin contains information about 1 vulnerability.

1) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service by crashing the Node.js process.

The vulnerability exists due to an uncaught exception in i18next-fs-backend's missing-key write queue when request-controlled language codes collide with the internal write-lock map. A remote attacker can trigger missing-key saves using language "locks" followed by language "translation", both with namespace "translation", to terminate the process through an unhandled timer exception, or reverse the collision order to fail an individual save call.

Remediation

Install update from vendor's website.

References

• https://github.com/i18next/i18next-fs-backend/security/advisories/GHSA-c8x8-9354-6f5m
• https://github.com/i18next/i18next-fs-backend/commit/a18340c