Uncaught Exception in i18next-fs-backend - #VU164490
Published: November 10, 2026
Vulnerability identifier: #VU164490
CSH Severity: Medium
CVSS v4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-248
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service by crashing the Node.js process.
The vulnerability exists due to an uncaught exception in i18next-fs-backend's missing-key write queue when request-controlled language codes collide with the internal write-lock map. A remote attacker can trigger missing-key saves using language "locks" followed by language "translation", both with namespace "translation", to terminate the process through an unhandled timer exception, or reverse the collision order to fail an individual save call.
Affected software
i18next-fs-backend
Remediation
Install security update from vendor's website.
i18next-fs-backend - update to 2.6.11