CVE-2026-40299 Details
Description
next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. The problem has been patchedin `[email protected]`.
A moderate open redirect vulnerability exists in the next-intl package for Next.js, affecting versions prior to 4.9.1. When the next-intl middleware is used with 'localePrefix: as-needed', it can be exploited to redirect users to external sites. This occurs because the URL parser removes certain control characters, allowing malicious URLs to bypass normal path handling. As a result, users may be redirected away from a trusted application URL without their consent.
Users are advised to update to next-intl version 4.9.1, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Apr 17, 2026CISA-ADP
Assessed Apr 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6 | [email protected] | Source CodeVendor |
| https://github.com/amannn/next-intl/pull/2304 | [email protected] | Issue TrackingSource CodeVendor |
| https://github.com/amannn/next-intl/releases/tag/v4.9.1 | [email protected] | Release NotesVendor |
| https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| amannn next-intl | All versions |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 17, 2026 | New CVE Received | [email protected] |