Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could construct URLs where path handling and the WHATWG URL parser resolved a relative redirect target to another host (e.g. scheme-relative `//` or control characters stripped by the URL parser), so the middleware could redirect the browser off-site while the user still started from a trusted app URL. The problem has been patchedin `[email protected]`.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-40299 next-intl provides internationalization for Next.js. Applications using the `next-intl` middleware prior to version 4.9.1with `localePrefix: 'as-needed'` could constr… https://www.cve.org/CVERecord?id=CVE-2026-40299
Post summary
The text reports the existence of CVE-2026-40299, detailing the affected Next.js middleware and configuration, but offers no evidence of exploitation, PoC, or patch.
CVE-2026-40299 Open Redirect Vulnerability in next-intl Middleware Prior to Version 4.9.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40299
Post summary
A new open redirect vulnerability affecting next-intl middleware versions earlier than 4.9.1 has been identified, with details posted on Vulmon.