{"answers":{"affected":"2 open source packages ship an affected version, including next-intl.","exploited":"There is no known exploitation of GHSA-4c35-wcg5-mm9h in the wild and no public exploit code.","fix":"Upgrade next-intl to 4.9.2 or later.","what":"GHSA-4c35-wcg5-mm9h is a vulnerability in next-intl, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-4c35-wcg5-mm9h and fix it if it is affected.\n\nWhat it is: GHSA-4c35-wcg5-mm9h is a vulnerability in next-intl, published on 6 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-4c35-wcg5-mm9h in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- next-intl (npm): affected all versions; fixed in 4.9.2\n- next-intl (npm): affected all versions; fixed in 4.9.2\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-4c35-wcg5-mm9h/ (Markdown: https://insights.sbomify.com/GHSA-4c35-wcg5-mm9h/index.md)","id":"GHSA-4c35-wcg5-mm9h","markdown":"https://insights.sbomify.com/GHSA-4c35-wcg5-mm9h/index.md","name":"GHSA-4c35-wcg5-mm9h","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["code_execution"],"network_reachable":"yes","non_default_config":true,"product_category":"Next.js i18n library","requires_auth":"none","summary":"Prototype pollution in next-intl allows attackers to execute arbitrary code during the build process if experimental precompilation is enabled.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"## Summary\n\n`setNestedProperty` in `packages/next-intl/src/extractor/utils.tsx` walks a dotted key path and assigns the final value without blocking the reserved keys `__proto__`, `constructor`, or `prototype`. When the next-intl Next.js plugin is configured with `experimental.messages` and `messages.precompile: true`, a JSON translation catalog containing a top‑level `__proto__` key causes `setNestedProperty(result, '__proto__.isAdmin', compiledMessage)` to assign onto `Object.prototype`, polluting every object in the running build process.\n\n## Details\n\nRoot cause — `packages/next-intl/src/extractor/utils.tsx:13-34`:\n\n```ts\nexport function setNestedProperty(\n  obj: Record\u003cstring, any\u003e,\n  keyPath: string,\n  value: any\n): void {\n  const keys = keyPath.split('.');\n  let current = obj;\n\n  for (let i = 0; i \u003c keys.length - 1; i++) {\n    const key = keys[i];\n    if (\n      !(key in current) ||\n      typeof current[key] !== 'object' ||\n      current[key] === null\n    ) {\n      current[key] = {};\n    }\n    current = current[key];\n  }\n\n  current[keys[keys.length - 1]] = value;\n}\n```\n\nThe existence check `!(key in current)` uses the `in` operator, which walks the prototype chain. For `key === '__proto__'`, `'__proto__' in {}` is `true` (it's inherited from `Object.prototype`) and `typeof current['__proto__'] === 'object'` (it *is* `Object.prototype`). The guard therefore never re-initializes `current[key]`, and `current = current['__proto__']` redirects all subsequent writes onto `Object.prototype`. The final assignment `current[keys[keys.length-1]] = value` sets `Object.prototype[\u003cattacker key\u003e] = \u003cattacker value\u003e`.\n\nBuild-time data flow:\n\n1. `packages/next-intl/src/plugin/catalog/catalogLoader.tsx:55-83` — the webpack/turbopack loader receives the catalog file `source` and, if `options.messages.precompile` is enabled, calls `codec.decode(source, {locale})`.\n2. `packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx:9-18` — `decode` runs `JSON.parse(source)`. V8 installs `__proto__` as an **own data property** on the result when the JSON key is literally `\"__proto__\"` (bypassing the normal `Object.prototype.__proto__` setter that would otherwise reassign the prototype).\n3. `JSONCodec.tsx:33-53` — `traverseMessages` iterates `Object.keys(obj)`, which for a JSON‑parsed object includes the own `__proto__` key. It reads `obj.__proto__` (returns the attacker’s nested object, not `Object.prototype`, because it's an own property), recurses into it, and emits message id `__proto__.isAdmin`.\n4. `catalogLoader.tsx:71` — `precompileMessages(decoded, cache)`.\n5. `catalogLoader.tsx:89-131` — for each message, calls `setNestedProperty(result, message.id, compiledMessage)`. With `message.id === '__proto__.isAdmin'`, `setNestedProperty` walks into `Object.prototype` and assigns `Object.prototype.isAdmin = compiledMessage`.\n\nThe same sink is also reachable via `JSONCodec.encode` (`JSONCodec.tsx:20-26`) and `POCodec` (`packages/next-intl/src/extractor/format/codecs/POCodec.tsx:87`) during extraction, both of which feed attacker-influenced `message.id` values into `setNestedProperty` — but those paths require control of source-code identifiers, which is a weaker attack vector than the build-time catalog path above.\n\nAfter pollution, every subsequent object access during the remainder of the Next.js build pipeline (webpack, turbopack, babel, next-intl’s own logic) inherits the attacker-controlled properties. This is a classic gadget-chain precondition for corrupting build-tool internals and tampering with generated bundles, since many build tools use patterns like `if (obj.someFlag)` or `options[key] ?? default` that are sensitive to polluted prototypes.\n\nTrust boundary note: next-intl’s message catalogs are realistically attacker-influenced in practice. Translation files are routinely round-tripped through external TMS systems (Crowdin, Lokalise, Transifex), accepted via community locale PRs, or pulled from third-party translation packages — any of which can carry a crafted `__proto__` key unnoticed, since JSON translation diffs are usually merged with minimal scrutiny.\n\n## PoC\n\nPrerequisites: a Next.js project using next-intl ≤ 4.9.1 with the Next.js plugin configured:\n\n```ts\n// next.config.ts\nimport createNextIntlPlugin from 'next-intl/plugin';\n\nconst withNextIntl = createNextIntlPlugin({\n  experimental: {\n    messages: {\n      path: './messages',\n      format: 'json',\n      locales: 'infer',\n      precompile: true\n    }\n  }\n});\n\nexport default withNextIntl({});\n```\n\n1. Drop a malicious catalog at `messages/en.json`:\n\n   ```json\n   {\n     \"Greeting\": \"Hello\",\n     \"__proto__\": { \"isAdmin\": \"polluted\" }\n   }\n   ```\n\n2. Run `next build` (or `next dev`). The `catalogLoader` will invoke `JSONCodec.decode` → `traverseMessages` → `precompileMessages` → `setNestedProperty`.\n\n3. Minimal reproduction of the sink itself (verified locally against the v4.9.1 source):\n\n   ```js\n   function setNestedProperty(obj, keyPath, value) {\n     const keys = keyPath.split('.');\n     let current = obj;\n     for (let i = 0; i \u003c keys.length - 1; i++) {\n       const key = keys[i];\n       if (!(key in current) || typeof current[key] !== 'object' || current[key] === null) {\n         current[key] = {};\n       }\n       current = current[key];\n     }\n     current[keys[keys.length - 1]] = value;\n   }\n\n   setNestedProperty({}, '__proto__.isAdmin', 'PWNED');\n   console.log(({}).isAdmin); // -\u003e \"PWNED\"\n   ```\n\n   Output: `PWNED`.\n\n4. Full chain reproduction (also verified):\n\n   ```js\n   const parsed = JSON.parse('{\"Greeting\":\"Hello\",\"__proto__\":{\"isAdmin\":\"polluted\"}}');\n   // traverseMessages emits: [{id:\"Greeting\",message:\"Hello\"},{id:\"__proto__.isAdmin\",message:\"polluted\"}]\n   // precompileMessages then calls setNestedProperty(result, \"__proto__.isAdmin\", \"polluted\")\n   console.log(({}).isAdmin); // -\u003e \"polluted\"\n   ```\n\n   After the loader runs, `({}).isAdmin === 'polluted'` for the remainder of the build Node process.\n\n## Impact\n\n- `Object.prototype` is polluted for the lifetime of the build‑time Node.js process, affecting every object created or inspected thereafter in the Next.js build pipeline (webpack/turbopack loaders, babel plugins, next-intl’s own codecs, user plugins).\n- Classic CWE-1321 gadget-chain precondition: downstream tools that branch on `obj.someFlag`, `options[key] ?? default`, `if (!config.noX)`, etc. can be coerced into unintended behavior, including emitting tampered bundles.\n- Realistic delivery vectors include TMS round-trips (Crowdin/Lokalise/Transifex), community locale PRs, and compromised/transitively-installed translation packages — all situations where a JSON catalog diff is routinely accepted without the scrutiny given to code changes.\n- Exploitation requires the user to opt in to the `experimental.messages` + `precompile` configuration. Users who do not use the extractor/precompile features are not affected.\n\n## Recommended Fix\n\nReject reserved keys in `setNestedProperty` and stop using the `in` operator for the existence check. A minimal patch to `packages/next-intl/src/extractor/utils.tsx`:\n\n```ts\nconst FORBIDDEN_KEYS = new Set(['__proto__', 'constructor', 'prototype']);\n\nexport function setNestedProperty(\n  obj: Record\u003cstring, any\u003e,\n  keyPath: string,\n  value: any\n): void {\n  const keys = keyPath.split('.');\n  for (const key of keys) {\n    if (FORBIDDEN_KEYS.has(key)) {\n      throw new Error(`Invalid message id segment: ${key}`);\n    }\n  }\n\n  let current = obj;\n  for (let i = 0; i \u003c keys.length - 1; i++) {\n    const key = keys[i];\n    if (\n      !Object.prototype.hasOwnProperty.call(current, key) ||\n      typeof current[key] !== 'object' ||\n      current[key] === null\n    ) {\n      current[key] = Object.create(null);\n    }\n    current = current[key];\n  }\n\n  current[keys[keys.length - 1]] = value;\n}\n```\n\nAdditionally:\n\n- In `packages/next-intl/src/extractor/format/codecs/JSONCodec.tsx`, make `traverseMessages` skip reserved keys (or switch to `Object.create(null)` +","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"`setNestedProperty` in `packages/next-intl/src/extractor/utils.tsx` walks a dotted key path and assigns the final value without b","id":"GHSA-4c35-wcg5-mm9h","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"npm","product":null,"products":[],"type":"other","year":"2026"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["0"],"last_affected":[],"package":"next-intl","purl":null,"source":"GHSA-4c35-wcg5-mm9h"},{"ecosystem":"npm","fixed":["4.9.2"],"introduced":["0"],"last_affected":[],"package":"next-intl","purl":"pkg:npm/next-intl","source":"GHSA-4c35-wcg5-mm9h"}],"products":null,"published":"2026-05-06","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Prototype pollution in next-intl allows attackers to execute arbitrary code during the build process if experimental precompilation is enabled.","url":"https://insights.sbomify.com/GHSA-4c35-wcg5-mm9h/"}