# CVE-2026-63402: i18next: Shared built-in corruption through inherited-key deepExtend recursion

Status: published. Published: 2026-10-30. Updated: 2026-11-05.

i18next is an internationalization framework for JavaScript. Prior to version 26.3.4, `deepExtend` in `src/utils.js` checks property existence with the in operator and recurses into inherited built-ins reached through `Object.prototype`. An application must explicitly pass attacker-controlled resource data to `addResourceBundle(lng, ns, data, deep, overwrite)` with both `deep: true` and `overwrite: true`. Source keys such as `hasOwnProperty`, `toString` and `valueOf` can then select shared inherited built-in function objects, and a nested value can overwrite a property of those objects process-wide. For example, making `Object.prototype.hasOwnProperty.call` non-callable causes subsequent uses, including i18next internals, to throw TypeError, resulting in unrecoverable denial of service and limited integrity impact. The `__proto__`/`constructor` guard does not prevent this mechanism because the corruption target is an inherited built-in function rather than the prototype object itself. Default calls without deep merging or with overwrite falsy are unaffected, and no standard i18next backend or integration uses the vulnerable configuration. This issue is distinct from the setPath/key-walking prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and i18next-http-middleware (CVE-2026-48714). This issue is fixed in version 26.3.4.

## Remediation

- fix: i18next (npm): GitHub reports patched versions 26.3.4. Check the advisory for the affected release branch. (source: GitHub GHSA-6jcc-5g8w-32mx) — https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx

## Affected products and versions

- i18next / i18next: < 26.3.4 (affected). Source: CNA: GitHub_M
-  / i18next (i18next): <= 26.3.3 (affected, GitHub advisory range). Source: GitHub GHSA-6jcc-5g8w-32mx

## Severity and prioritization

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H; source: CNA: GitHub_M

- CVSS 3.1: 5.9 (medium); CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H; source: NVD: security-advisories@github.com

- CISA KEV: No listing in collected sources

- EPSS: 0.26% as of 2026-11-04; percentile 18.39%

- SSVC: exploitation poc; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-471, CWE-1321

## Exploit evidence

- exploit: https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx (ADP: CISA-ADP)

## References

- https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx (CNA: GitHub_M; x_refsource_CONFIRM)

- https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/i18next/i18next/tree/v26.3.4 (CNA: GitHub_M; x_refsource_MISC)

- https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx (ADP: CISA-ADP; exploit)

- https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a (security-advisories@github.com)

- https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx (security-advisories@github.com)

- https://github.com/i18next/i18next/tree/v26.3.4 (security-advisories@github.com)

- https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx (GitHub Security Advisories; advisory)

## Provenance

- CNA: GitHub_M: https://www.cve.org/CVERecord?id=CVE-2026-63402; retrieved 2026-11-05; source updated 2026-11-05

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-63402; retrieved 2026-11-03; source updated 2026-11-02

- GitHub Security Advisories: https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx; retrieved 2026-11-04; source updated 2026-07-16

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-63402; retrieved 2026-11-05; source updated Not reported

Revision: 1a6a076ef08f73ebb32e3d4bb07575eefe26521e2b23430609cd6b0833e28e80

Canonical: https://y2.dev/cve/CVE-2026-63402

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.