Cross-site scripting in Next.js - #VU130273
Published: May 6, 2026
Vulnerability identifier: #VU130273
CSH Severity: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Next.js
Next.js
Software vendor:
vercel
vercel
Description
The vulnerability allows a remote attacker to execute arbitrary script in victims' browsers.
The vulnerability exists due to cross-site scripting in App Router HTML rendering when processing malformed nonce values derived from request headers behind shared caches. A remote attacker can supply a malformed nonce value to poison cached responses and execute arbitrary script in victims' browsers.
User interaction is required, and exploitation affects App Router applications that rely on CSP nonces when deployed behind shared caches.
Remediation
Install security update from vendor's website.