UpHeron
All vulnerabilities

npm

GHSA-4c35-wcg5-mm9h

next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys

Severity
Medium 4.2
Published
6 May 2026
Last changed
6 May 2026
Added to UpHeron
22 Oct 2026
Fixed in
4.9.2
Sources
OSV.dev and GitHub

Affected software

SoftwareAffected versions
next-intlnpm · osv:npm:next-intl
  • Every version before 4.9.2

References