A crafted missing-key string that includes a double underscore followed by a dot, such as "__proto__.polluted", is parsed by the backend’s missing-key persistence routine. The string is split on the configured key separator (by default ".") and the walker traverses the resulting path segment by segment. Because the walker does not guard against unsafe segments, the traversal extends into Object.prototype, allowing the attacker to inject arbitrary properties onto the global prototype. This form of prototype pollution can compromise application stability, corrupt translation data, poison configuration values, and bypass property-based security checks. The weakness is identified as CWE‑1321.

All installations of i18next‑fs‑backend older than version 2.6.6 that use the default key separator and expose the missingKeyHandler to untrusted input are impacted. The flaw is triggered when an application mounts i18next-http-middleware’s missingKeyHandler or otherwise calls i18next.t with saveMissing set to true. If the key separator is disabled (keySeparator set to false) or if the middleware is not reachable from untrusted users, the vulnerability is not exploitable. The issue is resolved in version 2.6.6.

The vulnerability carries a CVSS score of 9.1, reflecting a high severity. The EPSS score is below 1 %, indicating a low estimated exploitation probability at present, and the issue is not listed in the CISA KEV catalog. However, the attack requires only a crafted HTTP request to the missingKeyHandler or an equivalent entry point, making the potential impact wide ranging if the application permits unauthenticated access. An attacker could cause denial of service, corrupt translation or configuration data, or potentially establish a foothold for further exploitation depending on the host application’s safeguards.