Skip to content
OpenAdvisories

Package · npm

next-intl

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 4.2
    GHSA-4c35-wcg5-mm9h

    next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

    ## Summary `setNestedProperty` in `packages/next-intl/src/extractor/utils.tsx` walks a dotted key path and assigns the final value without blocking the reserved keys `__proto__`, `constructor`, or `prototype`. When the next-intl Next.js plugin is configured w…

    next-intl npm
  • Medium 6.9
    CVE-2026-40299

    next-intl has an open redirect vulnerability

    next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to…

    amannn next-intl next-intl npm