CVE-2026-63402 | i18next up to 26.3.3 Deep Merge src/utils.js deepExtend deep/overwrite dynamically-managed code resources

October 31, 2026 Yanac

A vulnerability described as problematic has been identified in i18next up to 26.3.3. This affects the function deepExtend of the file src/utils.js of the component Deep Merge. Executing a manipulation of the argument deep/overwrite can lead to dynamically-managed code resources.

This vulnerability appears as CVE-2026-63402. The attack may be performed from remote. There is no available exploit.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More