Executive brief
Next.js is a popular framework used for building web applications. A security flaw in certain versions allows attackers to inject malicious scripts into the website by manipulating security headers. If the site uses a shared cache, this malicious script could be stored and served to other visitors, potentially leading to unauthorized actions or data theft.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Next.js App Router applications that utilize Content Security Policy (CSP) nonces. The root cause is the unsafe reflection of malformed nonce values derived from request headers into the rendered HTML. When an application is deployed behind a shared cache, an attacker can send a request with a crafted nonce header to poison the cache with a malicious payload. Subsequent users receiving the cached response will execute the injected script. The vulnerability is fixed in versions 15.5.16 and 16.2.5 by implementing stricter nonce sanitization and rejecting malformed values.
Affected products
- Vercel Next.js >= 13.4.0, < 15.5.16; >= 16.0.0, < 16.2.5
Timeline
- 2026-05-06: advisory: GitHub advisory published by Vercel
- 2026-05-13: disclosed: NVD publication date