unstale

npm / i18next-http-backend

i18next-http-backend

What changed in i18next-http-backend 3 to 4, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-20.

7 breaking3 security1 new APIs and options1 performance2 fixes and other

See which of these apply to your code, ranked, in your agent:

npx @unstale/cli init

@unstale/cli 0.2.0 on npm

i18next-http-backend 412 changes

Breaking changes 7

  • Values containing &, = or ; are rejected to prevent query parameter pollution when lng is interpolated into query-shaped loadPath or addPath templates.

    4.0.4release notes

  • Values containing &, = or ; are rejected to prevent query parameter pollution when ns is interpolated into query-shaped loadPath or addPath templates.

    4.0.4release notes

  • Values containing : are now rejected to prevent URL injection when a loadPath or addPath template starts with a placeholder.

    4.0.2release notes

  • Values containing : or // are now rejected to prevent URL injection when a loadPath or addPath template starts with a placeholder.

    4.0.2release notes

  • The minimum supported Node version is now 18, so projects using older Node versions must upgrade or stay on v3.x.

    4.0.0release notes

  • The backend no longer provides cross-fetch and requires a host-provided fetch; runtimes without native fetch need a ponyfill injected through options.alternateFetch or must stay on v3.x.

    4.0.0release notes

  • XHR and ActiveXObject are still detected when provided by the host, but are no longer polyfilled.

    4.0.0release notes

Security 2

  • The interpolated URL is now checked as a whole, preventing requests to protocol-relative URLs when loadPath or addPath templates do not start with // or \.

    4.0.3release notes

  • i18next-http-backend incomplete URL validation permits SSRF

    4.0.2security advisory

New APIs and options 1

  • Use options.alternateFetch to inject a fetch ponyfill, mock fetch in tests, or intercept requests.

    4.0.0release notes

Performance 1

  • The package declares sideEffects as false, enabling downstream bundlers to apply tree-shaking accordingly.

    4.0.0release notes

Fixes and other changes 1

  • Allows @ in ns values so scoped-package-style namespace names fetch correctly; @ remains blocked for lng.

    4.0.1release notes

i18next-http-backend 32 changes

Security 1

  • i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns

    3.0.5security advisory

Fixes and other changes 1

  • Namespace values can contain forward slashes again, allowing nested namespace names to fetch correctly through loadPath.

    3.0.6release notes