The middleware's missingKeyHandler was designed to reject dangerous keys such as "__proto__", "constructor", and "prototype". However, in versions prior to 3.9.7 it would allow dotted keys like "__proto__.polluted". When a downstream backend splits the key on a configured keySeparator and passes the parts to an unguarded setPath() walker, that path writes directly to Object.prototype. This behavior satisfies CWE‑1321 because an attacker can alter prototype properties on behalf of the application. The vulnerability can be triggered by sending a crafted request body with a dotted key example. The impact depends on the host application but can include application crashes, corrupted translation behavior, configuration poisoning, or bypasses of property‑based security checks.

The affected product is i18next i18next-http-middleware when its missingKeyHandler is exposed to untrusted input. The vulnerability exists in all releases before 3.9.7. Additionally, any downstream backend that splits the missing key string on a keySeparator – notably i18next-fs-backend versions up to 2.6.5 – is vulnerable. Common host environments include Node.js frameworks like Express, Fastify, and Deno runtimes. Remediation requires upgrading the middleware (or the backend) beyond the vulnerable version or applying the indicated mitigations.

The CVSS score is 9.1, categorizing it as critical. The EPSS score is below 1 %, indicating a low but non‑zero exploitation probability. Because the vulnerability is not listed in the CISA KEV catalog, there is no known widespread exploit. The likely attack vector is via an HTTP request to the missingKeyHandler route that contains a dotted key. If the backend that processes the missing key is unprotected, prototype values are overwritten, allowing potential configuration or code manipulation depending on the target application. Prompt mitigation via an upgrade and the available work‑arounds is therefore strongly recommended.