# What changed in next-intl

> 5 changes in next-intl 4 from its official release notes, upgrade guides and advisories: 2 security. Each one cited. Sources checked 2026-10-24. HTML: https://unstale.sh/npm/next-intl/

To see which of these apply to a repository, run `npx @unstale/cli init` in it.

## next-intl 4

### Security

- next-intl has prototype pollution with `experimental.messages.precompile` via attacker-controlled translation catalog keys (4.9.2) — [security advisory](https://github.com/advisories/GHSA-4C35-WCG5-MM9H)
- next-intl has an open redirect vulnerability (4.9.1) — [security advisory](https://github.com/advisories/GHSA-8F24-V5VV-GM5J)

### Fixes and other changes

- Improvements for useExtracted; the notes do not specify further details. (4.14.9) — [release notes](https://github.com/amannn/next-intl/releases/tag/v4.14.9)
- Messages on the same line now keep source order. (4.14.8) — [release notes](https://github.com/amannn/next-intl/releases/tag/v4.14.8)
- Adds an optional peer dependency to support global virtual stores of package managers. (4.14.7) — [release notes](https://github.com/amannn/next-intl/releases/tag/v4.14.7)