{"id":"EUVD-2026-23543","enisaUuid":"86fe3a8f-4004-3dd7-998b-aa9183edd9ce","description":"next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: \u0027as-needed\u0027` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. The problem has been patchedin `next-intl@4.9.1`.","datePublished":"Apr 17, 2026, 8:49:05 PM","dateUpdated":"Apr 20, 2026, 3:58:51 PM","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j\nhttps://github.com/amannn/next-intl/pull/2304\nhttps://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6\nhttps://github.com/amannn/next-intl/releases/tag/v4.9.1\n","aliases":"CVE-2026-40299\nGHSA-8f24-v5vv-gm5j\n","assigner":"GitHub_M","epss":0.34,"enisaIdProduct":[{"id":"6e4f8b96-92c6-3a2f-9997-9f849a31f9a9","product":{"name":"next-intl","vendor":{"name":"amannn"}},"product_version":"\u003c 4.9.1"}],"enisaIdVendor":[{"id":"3ccbadcd-1fbe-3d4e-aae8-dadbb23a260f","vendor":{"name":"amannn"}}],"enisaIdVulnerability":[{"id":"f0c9a87f-ccee-3fef-ac0b-a78d9ec0e028","vulnerability":{"id":"GHSA-8f24-v5vv-gm5j","description":"next-intl has an open redirect vulnerability","datePublished":"Apr 10, 2026, 9:03:55 PM","dateUpdated":"Apr 24, 2026, 8:48:37 PM","baseScore":0.0,"references":"https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-40299\nhttps://github.com/amannn/next-intl/pull/2304\nhttps://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6\nhttps://github.com/amannn/next-intl\nhttps://github.com/amannn/next-intl/releases/tag/v4.9.1\n","enisa_id":"EUVD-2026-23543\n","aliases":"GHSA-8f24-v5vv-gm5j\nCVE-2026-40299\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:55:10 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"f5570945-f5d2-3e6b-bd04-a110806c7340","vulnerability":{"id":"CVE-2026-40299","description":"next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: \u0027as-needed\u0027` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. The problem has been patchedin `next-intl@4.9.1`.","datePublished":"Apr 17, 2026, 8:49:05 PM","dateUpdated":"Apr 20, 2026, 3:58:51 PM","status":"PUBLISHED","baseScore":6.9,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","references":"https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j\nhttps://github.com/amannn/next-intl/pull/2304\nhttps://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6\nhttps://github.com/amannn/next-intl/releases/tag/v4.9.1\n","enisa_id":"EUVD-2026-23543\n","assigner":"GitHub_M","epss":0.34,"dataProcessed":"Oct 27, 2026, 7:16:42 AM","vulnerabilityProduct":[{"id":"b4d69360-4967-3076-8240-279fdc6086f1","product":{"name":"next-intl","vendor":{"name":"amannn"}},"product_version":"\u003c 4.9.1"}],"vulnerabilityVendor":[{"id":"c8247188-b0b0-32c5-875f-3ce156a59a6f","vendor":{"name":"amannn"}}]}}],"enisaIdAdvisory":[]}