CVE-2026-55451 with a CVSS score of 6.9 is a prototype pollution vulnerability in gettext-converter via crafted translation keys, affecting any application that converts translation data originating from an untrusted or user-controlled source, leading to denial of service and potentially enabling further attacks. The vulnerability exists in the js2i18next function which splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object; a key whose segment is __proto__ causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime. The affected package is gettext-converter with versions prior to 1.3.3.
We recommend you to update gettext-converter to version 1.3.3.[/subscribe_to_unlock_form]
CVE-2026-55451 with a CVSS score of 6.9 is a prototype pollution vulnerability in gettext-converter via crafted translation keys, affecting any application that converts translation data originating from an untrusted or user-controlled source, leading to denial of service and potentially enabling further attacks. The vulnerability exists in the js2i18next function which splits nested keys on the key separator (default ##) and uses each segment as a dynamic object key while building the output object; a key whose segment is __proto__ causes the converter to resolve Object.prototype as the nested write target and assign the translated value onto it, polluting Object.prototype for the whole runtime. The affected package is gettext-converter with versions prior to 1.3.3.
We recommend you to update gettext-converter to version 1.3.3.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]