Next.js Internationalization Middleware Vulnerability in next-intl

CVE-2026-40299

What is CVE-2026-40299?

The next-intl middleware for Next.js prior to version 4.9.1 has a vulnerability that allows for unsafe URL redirection. By manipulating the localePrefix: 'as-needed', attackers can construct URLs that redirect users from a trusted application to a potentially malicious site. This issue arises due to the mishandling of relative redirect targets by the WHATWG URL parser, potentially compromising user security. The vulnerability has been addressed in version 4.9.1 and users are strongly encouraged to update their installations to mitigate the risk.

References