Register | Log in

node-i18next

internationalization framework for JavaScript environments

Choose email to subscribe with

general

source: node-i18next (main)
version: 23.7.6-2
maintainer: Debian Javascript Maintainers (archive) (DMD)
uploaders: Nicolas Mora [DMD]
arch: all
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 19.8.4+dfsg-1
oldstable: 22.4.8-1
stable: 23.7.6-1
testing: 23.7.6-2
unstable: 23.7.6-2

versioned links

19.8.4+dfsg-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
22.4.8-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
23.7.6-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
23.7.6-2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libjs-i18next
node-i18next

action needed

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-63402: i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in sid high

There is 1 open security issue in sid.

1 important issue:

CVE-2026-63402: i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in forky high

There is 1 open security issue in forky.

1 important issue:

CVE-2026-63402: i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

Created: 2026-10-31 Last update: 2026-10-31 15:20

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-63402: i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

Created: 2026-10-31 Last update: 2026-10-31 15:20

A new upstream version is available: 26.5.11 high

A new upstream version 26.5.11 is available, you should consider packaging it.

Created: 2025-11-27 Last update: 2026-10-31 13:00

lintian reports 2 warnings normal

Lintian reports 2 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-08-31 Last update: 2026-08-31 04:32

debian/patches: 1 patch to forward upstream low

Among the 3 debian patches available in version 23.7.6-2 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-08-31 06:30

news

[2026-09-05] node-i18next 23.7.6-2 MIGRATED to testing (Debian testing watch)
[2026-08-30] Accepted node-i18next 23.7.6-2 (source) into unstable (Xavier Guimard)
[2023-11-23] node-i18next 23.7.6-1 MIGRATED to testing (Debian testing watch)
[2023-11-17] Accepted node-i18next 23.7.6-1 (source) into unstable (Nicolas Mora)
[2023-01-11] node-i18next 22.4.8-1 MIGRATED to testing (Debian testing watch)
[2023-01-05] Accepted node-i18next 22.4.8-1 (source) into unstable (Nicolas Mora)
[2022-10-31] node-i18next 21.10.0-2 MIGRATED to testing (Debian testing watch)
[2022-10-26] Accepted node-i18next 21.10.0-2 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-10-16] node-i18next 21.10.0-1 MIGRATED to testing (Debian testing watch)
[2022-10-10] Accepted node-i18next 21.10.0-1 (source) into unstable (Nicolas Mora)
[2022-10-08] node-i18next 21.9.2-1 MIGRATED to testing (Debian testing watch)
[2022-10-02] Accepted node-i18next 21.9.2-1 (source) into unstable (Nicolas Mora)
[2022-09-29] node-i18next 21.9.1-3 MIGRATED to testing (Debian testing watch)
[2022-09-23] Accepted node-i18next 21.9.1-3 (source) into unstable (Yadd) (signed by: Xavier Guimard)
[2022-08-29] node-i18next 21.9.1-1 MIGRATED to testing (Debian testing watch)
[2022-08-23] Accepted node-i18next 21.9.1-1 (source) into unstable (Nicolas Mora)
[2022-07-12] node-i18next 21.8.12-1 MIGRATED to testing (Debian testing watch)
[2022-07-04] Accepted node-i18next 21.8.12-1 (source) into unstable (Nicolas Mora)
[2022-06-09] node-i18next 21.8.8-1 MIGRATED to testing (Debian testing watch)
[2022-06-09] node-i18next 21.8.8-1 MIGRATED to testing (Debian testing watch)
[2022-06-04] Accepted node-i18next 21.8.8-1 (source) into unstable (Nicolas Mora)
[2022-06-03] Accepted node-i18next 21.8.7-1 (source) into unstable (Nicolas Mora)
[2022-05-27] node-i18next 21.8.3-1 MIGRATED to testing (Debian testing watch)
[2022-05-21] Accepted node-i18next 21.8.3-1 (source) into unstable (Nicolas Mora)
[2022-04-18] node-i18next 21.6.16-1 MIGRATED to testing (Debian testing watch)
[2022-04-13] Accepted node-i18next 21.6.16-1 (source) into unstable (Nicolas Mora)
[2022-03-17] node-i18next 21.6.14+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-03-12] Accepted node-i18next 21.6.14+dfsg-1 (source) into unstable (Nicolas Mora)
[2022-02-17] node-i18next 21.6.11+dfsg-1 MIGRATED to testing (Debian testing watch)
[2022-02-12] Accepted node-i18next 21.6.11+dfsg-1 (source) into unstable (Nicolas Mora)

1
2

bugs [bug history graph]

all: 1
RC: 0
I&N: 1
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 2)
buildd: logs, reproducibility
popcon
browse source code
other distros
security tracker
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 23.7.6-1build2

Debian Package Tracker — Copyright 2013-2025 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing