next-intl has an open redirect vulnerability
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 2 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. The problem has been patchedin `[email protected]`.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| amannn | next-intl | before 4.9.1 | 4.9.1 | Patch available | CNA |
| — | next-intl (npm) | before 4.9.1 | 4.9.1 | Patch available | GHSA-8f24-v5vv-gm5j |
- next-intl Vendoramannn Affected before 4.9.1 Fixed in 4.9.1 Patch available CNA
- next-intl (npm) Vendor— Affected before 4.9.1 Fixed in 4.9.1 Patch available GHSA-8f24-v5vv-gm5j
Remediation
- Fix · CNA next-intl (amannn) Fixed in 4.9.1
- Fix · GHSA-8f24-v5vv-gm5j next-intl (npm) Fixed in 4.9.1 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| streams for Apache Kafka 2 | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka 3 | Affected | No fix yet: Fix deferred |
Not affected: 2 products
- streams for Apache Kafka 2
- streams for Apache Kafka 3
Timeline
- 2026-10-02 Threatist record created from CVE-2026-40299
- 2026-10-03 Alias added: GHSA-8f24-v5vv-gm5j
References
Other 5
Sources
- CVE-2026-40299 · CVE Program
- CVE-2026-40299 · NVD
- FIRST EPSS
- GHSA-8f24-v5vv-gm5j · GitHub Advisory Database · CC BY 4.0
- CVE-2026-40299 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences