i18next’s deepExtend function could be manipulated by an attacker who supplies a crafted resource bundle to addResourceBundle with deep and overwrite both set to true. Keys that match inherited built‑in names such as hasOwnProperty, toString, or valueOf are interpreted as references to functions on Object.prototype. When these are overwritten, the functions become corrupt process‑wide, causing subsequent calls—including those from i18next internals—to throw errors and terminate the application. The result is an unrecoverable denial of service and a breach of integrity for the affected process.

This flaw exists in the i18next library before version 26.3.4. The affected product is the i18next JavaScript internationalization framework; any deployment that uses i18next v26.3.3 or older and invokes addResourceBundle with deep and overwrite enabled is vulnerable.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, but the flaw is not listed in the CISA KEV catalog. Exploitation requires the attacker to supply controlled resource data; no flaw is exposed by default i18next configurations or public integrations. If an attacker can supply such data, they can corrupt shared built‑ins and cause a denial of service and limited integrity compromise.