The vulnerability in the next‑intl middleware allows an attacker to influence the redirect target processed by the browser. By manipulating a relative redirect in an application using the middleware with localePrefix set to "as-needed", the WHATWG URL parser resolves the target to another host. This leads to the browser being sent to an off‑site domain while the user believes the navigation originates from a trusted application URL. The weakness is a classic open‑redirect flaw (CWE‑601). The impact is the potential for phishing, credential theft, or malicious site visits without user awareness.

The affected product is amannn's next‑intl, a package used for internationalization in Next.js applications. Systems that employ a version prior to 4.9.1 of next‑intl and have the localePrefix configuration set to "as-needed" are vulnerable. Versions 4.9.1 and newer contain the fix.

The vulnerability has a CVSS score of 6.9, indicating a moderate severity. The EPSS score is less than 1%, indicating low but non‑zero likelihood of exploitation, but the lack of a KEV listing suggests no widespread exploitation has been reported yet. However, open redirects are widely leveraged in phishing campaigns, so the risk remains non‑negligible. The attack vector is largely user‑initiated through navigation to a crafted link generated by the application.