The next-intl middleware for Next.js, before version 4.9.1, when configured with localePrefix: 'as-needed', improperly handles URL redirects. Specifically, the path handling combined with the WHATWG URL parser can interpret relative redirect targets (such as scheme-relative URLs starting with // or URLs with control characters stripped) as external hosts. This results in an open redirect vulnerability (CWE-601), allowing attackers to redirect users from a trusted application URL to an untrusted external site. The vulnerability has been addressed in next-intl version 4.9.1.

An attacker could exploit this vulnerability to redirect users from a trusted application URL to an untrusted external site without user interaction or privileges. This could facilitate phishing or other social engineering attacks by leveraging the trusted origin URL. The CVSS 4.0 base score is 6.9 (medium severity), indicating a moderate risk due to network attack vector, no required privileges or user interaction, and limited impact on integrity.

Upgrade next-intl to version 4.9.1 or later, where this open redirect vulnerability has been patched. There is no official vendor advisory provided here, but the description confirms the fix in version 4.9.1. Until upgrading, avoid using localePrefix: 'as-needed' or implement additional validation on redirect URLs to prevent off-site redirection.