Executive brief
Next.js is a popular framework used by developers to build web applications. A security flaw in how it handles certain scripts could allow an attacker to run malicious code in a user's web browser if the application displays untrusted content. This could lead to unauthorized actions being performed on behalf of the user or the theft of sensitive session information.
Technical details
A cross-site scripting (XSS) vulnerability exists in Next.js when using the 'beforeInteractive' script strategy. The root cause is that serialized script content was not safely HTML-escaped before being embedded into the document. An attacker providing untrusted input can break out of the intended script context to execute arbitrary JavaScript in the context of the victim's browser. This requires the application to be passing untrusted data into a beforeInteractive script and for a user to visit the affected page. The issue is fixed in versions 15.5.16 and 16.2.5 by properly escaping serialized script content.
Affected products
- Vercel Next.js 13.0.0 to < 15.5.16, 16.0.0 to < 16.2.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: CVE published to NVD