CVE-2026-40299: next-intl has an open redirect vulnerability
(updated )
Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.
References
- github.com/advisories/GHSA-8f24-v5vv-gm5j
- github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
- github.com/amannn/next-intl/pull/2304
- github.com/amannn/next-intl/releases/tag/v4.9.1
- github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j
- nvd.nist.gov/vuln/detail/CVE-2026-40299
Code Behaviors & Features
Detect and mitigate CVE-2026-40299 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →