The vulnerability is an unauthenticated prototype pollution flaw where an attacker can inject property keys into Object.prototype via the getResourcesHandler and missingKeyHandler. This can alter behavior of downstream code such as bypassing authorization checks or causing a type‑confusion denial of service, and in some execution environments can be escalated to remote code execution. The weakness is identified as a prototype pollution (CWE‑1321) and path traversal (CWE‑22) flaw that permits arbitrary modification of global object state.

The affected product is i18next-http-middleware used in Node.js web frameworks like Express, Fastify, or Deno. Versions older than 3.9.3 of the middleware are vulnerable. Applications that import the middleware package without updating to a newer release or applying the published fix are at risk.

The CVSS score of 8.6 indicates a high severity impact. The EPSS score is not available, but the lack of a published exploit anywhere indicates exploitation likelihood is uncertain. The flaw is not listed in the CISA KEV catalog. An unauthenticated HTTP client can trigger the vulnerability by providing crafted language or namespace parameters to the middleware endpoints, allowing an attacker to manipulate Object.prototype and potentially achieve RCE or DoS depending on downstream code.