next-intl vulnerabilities (npm)

2 vulnerabilities.

• next-intl npm next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys GHSA-4c35-wcg5-mm9h Fix available 4.2 MediumMay 6, 2026
• next-intl npm next-intl has an open redirect vulnerability CVE-2026-40299 Fix available 6.9 MediumApril 10, 2026