CVE-2026-63402
Description
A flaw was found in i18next. When an application merges translation resources with deep merging and overwriting enabled, the internal merge utility improperly processes inherited built-in functions. A remote attacker can exploit this issue by supplying specially crafted resource data to overwrite properties of shared process objects. This manipulation causes critical runtime operations to fail, resulting in an unrecoverable application crash and a Denial of Service (DoS).
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires specific non-default invocation parameters and direct exposure of translation bundle ingestion to untrusted user input. Standard deployments across Red Hat products bundled with i18next do not expose the required recursive merge and overwrite configuration to end-user input, substantially limiting practical exploitability in default production configurations. Consequently, the blast radius is restricted to instances where custom extensions or applications process untrusted language bundles with both recursive traversal and overwrite options intentionally enabled.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | 5.9 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | High | N/A | High |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | Low | N/A | Low |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
cve.org: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
