{"action":"Upgrade next-intl to 4.9.1 or later.","affected":[{"fixed":"4.9.1","introduced":"0"}],"component":"next-intl","cve_ids":["CVE-2026-40299"],"ecosystem":"npm","epss":0.0054,"exploited":false,"fixed_versions":["4.9.1"],"ghsa_id":"GHSA-8f24-v5vv-gm5j","id":"tcs_01M5KFCP3Q3EJNHXAEHN4SBPCQ","modified_at":"2026-05-05T16:04:42.763137Z","published_at":"2026-04-10T21:03:55Z","references":["https://osv.dev/vulnerability/GHSA-8f24-v5vv-gm5j","https://github.com/amannn/next-intl/security/advisories/GHSA-8f24-v5vv-gm5j","https://nvd.nist.gov/vuln/detail/CVE-2026-40299","https://github.com/amannn/next-intl/pull/2304","https://github.com/amannn/next-intl/commit/1c80b668aa6d853f470319eec10a3f61e78a70e6","https://github.com/amannn/next-intl","https://github.com/amannn/next-intl/releases/tag/v4.9.1"],"severity":{"label":"medium"},"sources":[{"source":"osv","source_id":"GHSA-8f24-v5vv-gm5j","url":"https://osv.dev/vulnerability/GHSA-8f24-v5vv-gm5j"}],"summary":"next-intl has an open redirect vulnerability"}