Inefficient regular expression complexity in i18next - #VU164399
Published: November 10, 2026
Vulnerability identifier: #VU164399
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-1333
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by blocking a server's event loop or hanging browser tabs.
The vulnerability exists due to exponential backtracking in the i18next nesting regular expression when processing strings containing an unclosed $t( prefix. A remote attacker can supply crafted interpolation values or translation keys containing the namespace separator to trigger excessive processing and block execution.
Affected software
i18next
Remediation
Install security update from vendor's website.
i18next - update to 26.4.4