Next Intl
Monthly
Open redirect vulnerability in next-intl middleware prior to version 4.9.1 allows remote attackers to craft malicious URLs that bypass path handling validation when `localePrefix: 'as-needed'` is configured, redirecting users to arbitrary hosts via scheme-relative URLs or control characters that the WHATWG URL parser strips. Unauthenticated attackers can exploit this through social engineering (phishing links) to redirect users from trusted application URLs to attacker-controlled domains. Patch available in [email protected].
Open redirect vulnerability in next-intl middleware prior to version 4.9.1 allows remote attackers to craft malicious URLs that bypass path handling validation when `localePrefix: 'as-needed'` is configured, redirecting users to arbitrary hosts via scheme-relative URLs or control characters that the WHATWG URL parser strips. Unauthenticated attackers can exploit this through social engineering (phishing links) to redirect users from trusted application URLs to attacker-controlled domains. Patch available in [email protected].