Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

npm package

next-intl

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 4.2npmAmendedPublished

    next-intl has prototype pollution with experimental.messages.precompile via attacker-controlled translation catalog keys

    GHSA-4c35-wcg5-mm9h

    Affected
    • npm next-intl <= 4.9.1
    Fixed in
    4.9.2· Vendor fix available
    Issue
    setNestedProperty in packages/next-intl/src/extractor/utils.tsx walks a dotted key path and assigns the final value without blocking the reserved keys proto, constructor, or prototype. When the next-intl Next.js plugin is configured with experimental.messages and messages.precompile: true, a JSON translation catalog containing a top‑level proto key causes setNestedProperty(result, 'proto.isAdmin', compiledMessage) to assign onto Object.prototype, polluting every object in the running build process. Details Root cause — packages/next-intl/src/extractor/utils.tsx:13-34: The existence check !(key in current) uses the in operator, which walks the prototype chain. For key === 'proto', 'proto' in {} is true (it's inherited from Object.prototype) and typeof current['proto'] === 'object' (it is Object.prototype). The guard therefore never re-initializes current[key], and current = current['proto'] redirects all subsequent writes onto Object.prototype. The final assignment…

    Recommended action: Upgrade to 4.9.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →
  2. Medium, CVSS 6.9npmAmendedPublished

    next-intl has an open redirect vulnerability

    CVE-2026-40299 · GHSA-8f24-v5vv-gm5j

    Affected
    • npm next-intl < 4.9.1
    Fixed in
    4.9.1· Vendor fix available
    Issue
    Impact Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. Patches The problem has been patched, please update to next-intl@4.9.1. Credits Many thanks to Joni Liljeblad from Oura for responsibly disclosing the vulnerability and for suggesting the fix.

    Recommended action: Upgrade to 4.9.1 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:osv.dev (1)github.com (2)Source checked Evidence →