The icu-minify library has a vulnerability in its runtime formatter for 'select' branches where user input is used as a key to look up options on a plain object that inherits from Object.prototype. If the input coerces to a key present on Object.prototype (e.g., toString, __proto__, constructor), the lookup returns a function instead of the expected fallback option, causing a TypeError and crashing the formatter. This can lead to denial of service in applications using icu-minify, such as Next.js SSR with next-intl's experimental precompilation feature, resulting in HTTP 500 errors on affected renders. The issue is fixed in version 4.9.2.