Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Low severity, with a CVSS score of 3.1, published 6 May 2026.

Which products and versions are affected?

icu-minify (npm) SEMVER:introduced=0,fixed=4.9.2.

Is there a fix for This vulnerability?

Yes. icu-minify (npm): upgrade to 4.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is This vulnerability attacked?

It is attacked over the network, in a software library.

Check whether you run icu-minify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

icu-minify prototype pollution denial of service in select branch lookup

Severity: low · CVSS 3.1 · Published 2026-05-06

icu-minify is a JavaScript library used for internationalization message formatting. When user input is passed into a select branch placeholder and the precompile feature is enabled, an attacker can crash the application by supplying property names that exist on Object.prototype (like "toString" or "constructor"), causing a denial-of-service condition that renders affected web pages inaccessible.

Vendors: npm.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Low severity, with a CVSS score of 3.1, published 6 May 2026.
Which products and versions are affected?: icu-minify (npm) SEMVER:introduced=0,fixed=4.9.2.
Is there a fix for This vulnerability?: Yes. icu-minify (npm): upgrade to 4.9.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is This vulnerability attacked?: It is attacked over the network, in a software library.
Am I affected?: Check whether you run icu-minify (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

icu-minify (npm): upgrade to 4.9.2 or later
```
npm install icu-minify@4.9.2
```

Technical details

The vulnerability is a prototype pollution-adjacent denial of service in icu-minify's select branch resolver. The `formatSelect()` function performs an unsanitized property lookup on an options object (which inherits from Object.prototype) using user-supplied string values as keys. When a user provides input that matches Object.prototype property names (toString, constructor, __proto__, hasOwnProperty, valueOf, etc.), the lookup returns the inherited function instead of undefined, bypassing the `?? options.other` fallback. The truthy function is then passed to `formatNodes()` which expects an iterable array, resulting in `TypeError: nodes is not iterable` and crashing the renderer. This affects direct icu-minify consumers and next-intl users with precompile mode enabled. No authentication is required; the attack vector is network-accessible form input or URL parameters. Patch version 4.9.2 is available.

Affected products

amannn icu-minify ≤ 4.9.1
amannn next-intl versions using icu-minify ≤ 4.9.1 with experimental.messages.precompile enabled

Timeline

2026-04-27: disclosed
2026-05-06: patched: icu-minify 4.9.2
2026-05-06: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.