Vulnerability	Vulnerable Version
M Prototype Pollution next-intl is an Internationalization (i18n) for Next.js Affected versions of this package are vulnerable to Prototype Pollution in the `setNestedProperty` function when processing translation catalog keys containing reserved properties such as `__proto__`, `constructor`, or `prototype`. An attacker can inject malicious properties into `Object.prototype`, impacting all objects created during the build process, by supplying a crafted JSON translation catalog with attacker-controlled keys. Note: This is only exploitable if the application is configured with both `experimental.messages` and `messages.precompile: true`. How to fix Prototype Pollution? Upgrade `next-intl` to version 4.9.2 or higher.	<4.9.2
M Open Redirect next-intl is an Internationalization (i18n) for Next.js Affected versions of this package are vulnerable to Open Redirect in the `middleware` process when `localePrefix` is set to 'as-needed'. An attacker can redirect users to an external site by crafting URLs that exploit the way relative redirect targets are resolved and handled by the URL parser. How to fix Open Redirect? Upgrade `next-intl` to version 4.9.1 or higher.	<4.9.1

Prototype Pollution

next-intl is an Internationalization (i18n) for Next.js

Affected versions of this package are vulnerable to Prototype Pollution in the setNestedProperty function when processing translation catalog keys containing reserved properties such as __proto__, constructor, or prototype. An attacker can inject malicious properties into Object.prototype, impacting all objects created during the build process, by supplying a crafted JSON translation catalog with attacker-controlled keys.

Note: This is only exploitable if the application is configured with both experimental.messages and messages.precompile: true.

How to fix Prototype Pollution?

Upgrade next-intl to version 4.9.2 or higher.

<4.9.2

Open Redirect

next-intl is an Internationalization (i18n) for Next.js

Affected versions of this package are vulnerable to Open Redirect in the middleware process when localePrefix is set to 'as-needed'. An attacker can redirect users to an external site by crafting URLs that exploit the way relative redirect targets are resolved and handled by the URL parser.

How to fix Open Redirect?

Upgrade next-intl to version 4.9.1 or higher.

<4.9.1

Go back to all versions of this package