AIKIDO-2026-428313

TL;DR

i18next-icu caches compiled ICU formatters using a memoize key built from the language, namespace, and translation key, written through an internal path walker. Only the translation key segment is escaped, so a namespace or language segment named __proto__, constructor, or prototype makes the walker descend into and assign onto Object.prototype. The language segment is taken from the requested language, so when language detection or other untrusted input drives translation with memoization enabled, this pollutes the global object prototype and affects every object created afterwards in the process. The fix makes the walker refuse unsafe path segments and drop the write, and option merging now skips prototype keys.