# What changed in i18next-http-backend

> 14 changes in i18next-http-backend 3 to 4 from its official release notes, upgrade guides and advisories: 7 breaking, 3 security, 1 new APIs and options. Each one cited. Sources checked 2026-10-20. HTML: https://unstale.sh/npm/i18next-http-backend/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## i18next-http-backend 4

### Breaking changes

- Values containing &, = or ; are rejected to prevent query parameter pollution when lng is interpolated into query-shaped loadPath or addPath templates. (4.0.4) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#404)
- Values containing &, = or ; are rejected to prevent query parameter pollution when ns is interpolated into query-shaped loadPath or addPath templates. (4.0.4) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#404)
- Values containing `:` are now rejected to prevent URL injection when a loadPath or addPath template starts with a placeholder. (4.0.2) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#402)
- Values containing `:` or `//` are now rejected to prevent URL injection when a loadPath or addPath template starts with a placeholder. (4.0.2) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#402)
- The minimum supported Node version is now 18, so projects using older Node versions must upgrade or stay on v3.x. (4.0.0) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#400)
- The backend no longer provides cross-fetch and requires a host-provided fetch; runtimes without native fetch need a ponyfill injected through options.alternateFetch or must stay on v3.x. (4.0.0) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#400)
- XHR and ActiveXObject are still detected when provided by the host, but are no longer polyfilled. (4.0.0) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#400)

### Security

- The interpolated URL is now checked as a whole, preventing requests to protocol-relative URLs when loadPath or addPath templates do not start with // or \. (4.0.3) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#403)
- i18next-http-backend incomplete URL validation permits SSRF (4.0.2) — [security advisory](https://github.com/advisories/GHSA-XVQ9-WJP8-HWQF)

### New APIs and options

- Use options.alternateFetch to inject a fetch ponyfill, mock fetch in tests, or intercept requests. (4.0.0) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#400)

### Performance

- The package declares sideEffects as false, enabling downstream bundlers to apply tree-shaking accordingly. (4.0.0) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#400)

### Fixes and other changes

- Allows `@` in `ns` values so scoped-package-style namespace names fetch correctly; `@` remains blocked for `lng`. (4.0.1) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#401)

## i18next-http-backend 3

### Security

- i18next-http-backend has Path Traversal & URL Injection via Unsanitised lng/ns (3.0.5) — [security advisory](https://github.com/advisories/GHSA-Q89C-Q3H5-W34G)

### Fixes and other changes

- Namespace values can contain forward slashes again, allowing nested namespace names to fetch correctly through loadPath. (3.0.6) — [release notes](https://github.com/i18next/i18next-http-backend/blob/b0eef9efd425055c554787cef7f878de33bbf510/CHANGELOG.md#306)