i18next

i18next internationalization framework

Latest 26.4.5

NPM

88%

Total Score

healthy

Long-lived, actively maintained release with strong project hygiene; all 13 workflow actions are unpinned.

Are you affected? Scan for Free

Health Score Breakdown

Lifecycle scripts

A prepare lifecycle script runs during installation or package preparation; its presence adds some execution surface, but no unsafe behavior is shown by this signal alone.

Workflow audit

Both workflows were analyzed successfully and have no untrusted checkouts or script injection, but all 13 action references are unpinned. The low-confidence cache-poisoning finding is hygiene rather than a standalone severe risk.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2026-387296 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. i18next is vulnerable to Prototype Pollution in versions 2.0.0 - 26.3.3.	2.0.0 - 26.3.3	Medium
AIKIDO-2026-10645 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. i18next is vulnerable to Regular Expression Denial of Service (ReDoS) in versions 2.0.0-alpha.24 - 26.0.5.	2.0.0-alpha.24 - 26.0.5	Medium
AIKIDO-2024-10543 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. i18next is vulnerable to Code Injection in versions 17.0.2 - 24.1.1.	17.0.2 - 24.1.1	High
CVE-2017-16008 i18next is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 1.10.2.	0.0.0 - 1.10.2	Medium
CVE-2017-16010 i18next is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 2.0.0 - 3.4.4.	2.0.0 - 3.4.4	Medium