GHSA-8f24-v5vv-gm5j: next-intl has an open redirect vulnerability

April 10, 2026

Applications using the next-intl middleware with localePrefix: 'as-needed' could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative // or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL.

References

github.com/advisories/GHSA-8f24-v5vv-gm5j
github.com/amannn/next-intl
github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6
github.com/amannn/next-intl/pull/2304
github.com/amannn/next-intl/releases/tag/v4.9.1
github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j

Code Behaviors & Features

Detect and mitigate GHSA-8f24-v5vv-gm5j with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →