GHSA-r27j-894h-3w3p

## Summary `icu-minify`'s runtime formatter resolves `select` branches by looking up the runtime value as a plain property on a prototype-bearing object. When the value coerces to a key that exists on `Object.prototype` (e.g. `toString`, `__proto__`, `constructor`, `hasOwnProperty`, `valueOf`), the lookup returns a truthy value that short-circuits the `?? options.other` fallback, and the downstream iterator crashes with `TypeError: nodes is not iterable`. Any consumer that forwards user input into a `{arg, select, …}` placeholder — a common idiom for `role`, `status`, `type`, `gender` — can be crashed per-request by supplying one of those keys. In Next.js SSR (via `next-intl` with `experimental.messages.precompile`) this yields a 500 for the affected render. ## Details ### Vulnerable code paths Compilation produces a plain object whose prototype chain includes all `Object.prototype` members: ```tsx // packages/icu-minify/src/compile.tsx:191-199 function compileSelect(node: SelectElement): CompiledNode { const options: SelectOptions = {}; // <-- plain object, inherits from Object.prototype for (const [key, option] of Object.entries(node.options)) { options[key] = compileNodesToNode(option.value); } return [node.value, TYPE_SELECT, options]; } ``` At runtime, the formatter looks up the user-controllable value directly on that object: ```tsx // packages/icu-minify/src/format.tsx:226-244 function formatSelect<RichTextElement>( name: string, options: SelectOptions, locale: string, values: FormatValues<RichTextElement>, formatOptions: FormatOptions, pluralCtx: PluralContext | undefined ): string | RichTextElement | Array<string | RichTextElement> { const value = String(getValue(values, name)); // 234: coerce to string, no sanitization const branch: CompiledNode | undefined = options[value] ?? options.other; // 235: unsafe lookup if (process.env.NODE_ENV !== 'production' && !branch) { throw new Error(