Your message dated Tue, 03 Nov 2026 11:49:09 +0000
with message-id <[email protected]>
and subject line Bug#1152688: fixed in node-i18next 26.7.1-1
has caused the Debian Bug report #1152688,
regarding node-i18next: CVE-2026-63402
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
1152688: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1152688
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Source: node-i18next
Version: 23.7.6-2
X-Debbugs-CC: [email protected]
Severity: important
Tags: security upstream
Hi,
The following vulnerability was published for node-i18next.
CVE-2026-63402[0]:
| i18next is an internationalization framework for JavaScript. Prior
| to version 26.3.4, `deepExtend` in `src/utils.js` checks property
| existence with the in operator and recurses into inherited built-ins
| reached through `Object.prototype`. An application must explicitly
| pass attacker-controlled resource data to `addResourceBundle(lng,
| ns, data, deep, overwrite)` with both `deep: true` and `overwrite:
| true`. Source keys such as `hasOwnProperty`, `toString` and
| `valueOf` can then select shared inherited built-in function
| objects, and a nested value can overwrite a property of those
| objects process-wide. For example, making
| `Object.prototype.hasOwnProperty.call` non-callable causes
| subsequent uses, including i18next internals, to throw TypeError,
| resulting in unrecoverable denial of service and limited integrity
| impact. The `__proto__`/`constructor` guard does not prevent this
| mechanism because the corruption target is an inherited built-in
| function rather than the prototype object itself. Default calls
| without deep merging or with overwrite falsy are unaffected, and no
| standard i18next backend or integration uses the vulnerable
| configuration. This issue is distinct from the setPath/key-walking
| prototype-pollution flaws in i18next-fs-backend (CVE-2026-48713) and
| i18next-http-middleware (CVE-2026-48714). This issue is fixed in
| version 26.3.4.
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
[0] https://security-tracker.debian.org/tracker/CVE-2026-63402
https://www.cve.org/CVERecord?id=CVE-2026-63402
[1] https://github.com/i18next/i18next/security/advisories/GHSA-6jcc-5g8w-32mx
[2]
https://github.com/i18next/i18next/commit/642137b7786d83661ec3ee53027798dc4b81d30a
Please adjust the affected versions in the BTS as needed.
Regards,
Salvatore
--- End Message ---
--- Begin Message ---
Source: node-i18next
Source-Version: 26.7.1-1
Done: Xavier Guimard <[email protected]>
We believe that the bug you reported is fixed in the latest version of
node-i18next, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [email protected],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Xavier Guimard <[email protected]> (supplier of updated node-i18next package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [email protected])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 03 Nov 2026 12:22:15 +0100
Source: node-i18next
Architecture: source
Version: 26.7.1-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Javascript Maintainers
<[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Closes: 1152688
Changes:
node-i18next (26.7.1-1) unstable; urgency=medium
.
* Team upload
* New upstream version 26.7.1 (Closes: #1152688, CVE-2026-63402)
* Drop build dependencies on node-babel-plugin-transform-runtime and
node-tape (tests moved to vitest upstream)
* Drop runtime dependency on node-babel-runtime
* Drop obsolete patches
Checksums-Sha1:
3324aea5fe32f4b521e9495fcc978e7efd352648 2387 node-i18next_26.7.1-1.dsc
e711a996ebcaaa55df34124a32144628d31d9d38 687992 node-i18next_26.7.1.orig.tar.gz
5b24f4337c4f7657b0c8cd21db2f7542ce76dbc7 4088
node-i18next_26.7.1-1.debian.tar.xz
Checksums-Sha256:
96e5e16a5cf53334fe4395155b42a7d003f76ae83f889bf62cee11381fe47b9b 2387
node-i18next_26.7.1-1.dsc
5c66a50240f12c236f68dae48822acc0cb0da88da735db9322fc58a5dd889654 687992
node-i18next_26.7.1.orig.tar.gz
86c8f2600b0881778d3c22d9add67736c18bced2b5810c02e81672a9852eb771 4088
node-i18next_26.7.1-1.debian.tar.xz
Files:
32600e3c8292667f62879df5c3f76486 2387 javascript optional
node-i18next_26.7.1-1.dsc
1ccd511d5602c8901c1a74a70f140993 687992 javascript optional
node-i18next_26.7.1.orig.tar.gz
77791c059a1328c874bb53d49742d4e9 4088 javascript optional
node-i18next_26.7.1-1.debian.tar.xz
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmrpxCUACgkQ9tdMp8mZ
7umqBQ//QzxN5sLyD8uAVeKGpUXJ9FHoYzhxDMw71SUbM5iJRAWLaFFL+mLpZI9d
k27G3NlW3Zwf7N2KNlSIabBxtM4HJzaHP1YXcilLmsr2ECtk6Q7XpXc33cuiMPNi
3ZP9m+kpmaCPXY690sqf8GwLU6cXCdvmEb4cI3iQu/XSvVCfosktvzpl0GjlvZLT
3BcU/DDlus+VOcBMXXFnsNf/f6AzxOXP0tyvJMfHuoAVfpaRaVcnfy73zNo94iQW
PVliziZgJIdNMk3cTSolquPMLySUJpO+Gb+kvUL2dWzFzJRpLDuCAWqmfh3ezQ4H
A1zWqWlPnaSTs0nV4mwi1ohyvEYdTjWwjqqfUUchlQDuT9gzsPrDUJhWhnPvG2IW
bRwVGGgipedj11QyKuSedNrwR/Q7mOw6NwOC3IgFYV/ZRN+nyWUHSvHThKrJbC5F
R75YNRDgLWXk7v3urZJV7GbvhSKO3vnP+IxDglB7/iXbikXjJluZYTbG/ytla0kK
kbGthqZD0zYtHTLJyLYa8xG4h/Gfe6fuM1AMOx6fgp0LOarFI5nvcAM3jlp2snul
aPtSVmDcCr3yLP+eCRdI+fb+cLSJE1iWaPu5Nfhz6FgTtyBuzqctZHtosvWm/CGH
9MvDN1iPCm9yioRxyvq3Q1arCwItiU5E967aiGiGT+YmXKV5UXU=
=wfPk
-----END PGP SIGNATURE-----
pgpZzb4P_V1UB.pgp
Description: PGP signature
--- End Message ---
--
Pkg-javascript-devel mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-javascript-devel
