The flaw in the translation loader allows an attacker to insert a placeholder that expands to an absolute URL or a protocol‑relative URL when constructing loadPath or addPath, leading to a server‑side request forgery scenario. An attacker could force the host to retrieve resources from arbitrary endpoints, potentially exfiltrating internal data or triggering unintended actions. This constitutes a confidentiality and integrity compromise, but does not directly enable code execution.

Any use of i18next-http-backend older than version 4.0.2—whether in Node.js, browser, or Deno environments—exposes this risk. Applications that allow user‑controlled language or namespace values to influence the path templates are directly impacted.

The CVSS score of 3.7 classifies the vulnerability as moderate severity, and the absence of a KEV listing suggests limited known exploitation. Attackers can trigger SSRF by supplying crafted language or namespace inputs that cause the loader to resolve to an unintended destination. The vulnerability can be exercised without authentication if the path parameters are exposed, implying low to moderate effort for impact delivery.