Executive brief
icu-minify is a JavaScript library used for internationalization message formatting. When user input is passed into a select branch placeholder and the precompile feature is enabled, an attacker can crash the application by supplying property names that exist on Object.prototype (like "toString" or "constructor"), causing a denial-of-service condition that renders affected web pages inaccessible.
Technical details
The vulnerability is a prototype pollution-adjacent denial of service in icu-minify's select branch resolver. The `formatSelect()` function performs an unsanitized property lookup on an options object (which inherits from Object.prototype) using user-supplied string values as keys. When a user provides input that matches Object.prototype property names (toString, constructor, __proto__, hasOwnProperty, valueOf, etc.), the lookup returns the inherited function instead of undefined, bypassing the `?? options.other` fallback. The truthy function is then passed to `formatNodes()` which expects an iterable array, resulting in `TypeError: nodes is not iterable` and crashing the renderer. This affects direct icu-minify consumers and next-intl users with precompile mode enabled. No authentication is required; the attack vector is network-accessible form input or URL parameters. Patch version 4.9.2 is available.
Affected products
- amannn icu-minify ≤ 4.9.1
- amannn next-intl versions using icu-minify ≤ 4.9.1 with experimental.messages.precompile enabled
Timeline
- 2026-04-27: disclosed
- 2026-05-06: patched: icu-minify 4.9.2
- 2026-05-06: advisory