{"action":"Upgrade next-intl to 4.9.2 or later.","affected":[{"fixed":"4.9.2","introduced":"0"}],"component":"next-intl","cve_ids":[],"ecosystem":"npm","exploited":false,"fixed_versions":["4.9.2"],"ghsa_id":"GHSA-4c35-wcg5-mm9h","id":"tcs_01M5KF029TVV6SVWRE9ARR84E6","modified_at":"2026-05-06T17:49:51.179177Z","published_at":"2026-05-06T17:34:12Z","references":["https://osv.dev/vulnerability/GHSA-4c35-wcg5-mm9h","https://github.com/amannn/next-intl/security/advisories/GHSA-4c35-wcg5-mm9h","https://github.com/amannn/next-intl"],"severity":{"label":"medium","score":4.2},"sources":[{"source":"osv","source_id":"GHSA-4c35-wcg5-mm9h","url":"https://osv.dev/vulnerability/GHSA-4c35-wcg5-mm9h"}],"summary":"next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys"}