AIKIDO-2026-387296

TL;DR

i18next merges resource bundles through deepExtend, used by addResourceBundle when called with the deep and overwrite options. It checked key existence with the in operator, which walks the prototype chain, so a source key matching an inherited built-in such as hasOwnProperty or toString caused recursion into the shared Object.prototype function. With overwrite enabled, this could overwrite a shared built-in like Object.prototype.hasOwnProperty.call with a non-callable value, corrupting it process-wide and causing denial of service. The fix checks existence with Object.prototype.hasOwnProperty.call so such keys are copied as plain own data instead.