# What changed in i18next-fs-backend

> 7 changes in i18next-fs-backend 2 from its official release notes, upgrade guides and advisories: 2 breaking, 4 security. Each one cited. Sources checked 2026-10-27. HTML: https://unstale.sh/npm/i18next-fs-backend/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## i18next-fs-backend 2

### Breaking changes

- Refuses paths whose root differs from the template's root, preventing `lng` or `ns` values from changing the resulting path type. (2.6.9) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#269)
- Filesystem paths are no longer built when ns contains traversal sequences, separators, control characters, prototype keys, or exceeds 128 characters, preventing arbitrary filesystem reads and writes. (2.6.4) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#264)

### Security

- Path traversal now descends only into own properties, closing an unauthenticated denial of service that could overwrite inherited Object.prototype members. (2.6.8) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#268)
- write() now iterates only own enumerable keys of queuedWrites, preventing prototype pollution from causing writeFile() calls. (2.6.7) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#267)
- Missing-key writes now refuse to traverse `__proto__`, `constructor`, or `prototype` segments, preventing prototype pollution from crafted keys. (2.6.6) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#266), [security advisory](https://github.com/advisories/GHSA-2933-Q333-QG83)
- i18next-fs-backend: Path traversal via unsanitised lng/ns allows arbitrary file read/overwrite (2.6.4) — [security advisory](https://github.com/advisories/GHSA-8847-338W-5HCJ), [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#264)

### Fixes and other changes

- Namespace values may contain forward slashes again, allowing nested namespace names to load from subfolder locale files. (2.6.5) — [release notes](https://github.com/i18next/i18next-fs-backend/blob/fa389bd318c6a7b045303cf2f3fd0c47c8f787f9/CHANGELOG.md#265)