CVE-2026-40299: next-intl has an open redirect vulnerability

CVE-2026-40299 · Severity: medium · CVSS 4 · Published 2026-04-17

next-intl is a library used to add internationalization (multi-language support) to Next.js applications. When using the middleware with a specific configuration option, attackers can craft malicious URLs that trick the application into redirecting users to external websites while appearing to originate from the trusted app. This could be used for credential theft, malware distribution, or phishing attacks.

Technologies: next-intl (npm). Vendors: npm.

Quick answers

Is CVE-2026-40299 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-40299 being exploited in the wild.
How severe is CVE-2026-40299?
Medium severity, with a CVSS score of 4, published 17 April 2026.
Which products and versions are affected?
next-intl (npm) < 4.9.1, SEMVER:introduced=0,fixed=4.9.1.
Is there a fix for CVE-2026-40299?
Yes. next-intl (npm): upgrade to 4.9.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-40299 attacked?
It is attacked over the network.
Am I affected by CVE-2026-40299?
Check whether you run next-intl (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • next-intl (npm): upgrade to 4.9.1 or later
    npm install next-intl@4.9.1

Technical details

The vulnerability is a classic open redirect (CWE-601) in the next-intl middleware when configured with localePrefix: 'as-needed'. The root cause lies in improper handling of relative redirect targets during path parsing; the WHATWG URL parser resolves scheme-relative URLs (e.g., //) or URLs with control characters that are stripped by the parser to external hosts. An attacker can construct a malicious URL that, when processed by the middleware, redirects the browser off-site while the initial request appears to originate from the trusted application. The vulnerability affects all versions prior to 4.9.1 and requires no authentication or user interaction beyond clicking a link. A patch is available in next-intl version 4.9.1.

Affected products

  • amannn next-intl < 4.9.1

Identifiers

  • CVE-2026-40299
  • GHSA-8f24-v5vv-gm5j

Timeline

  • 2026-04-10: disclosed
  • 2026-04-10: patched: Fixed in next-intl 4.9.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.