Next.js allows middleware to return redirects. If an attacker sends a request containing the x-nextjs-data header, the middleware treats the request as a data request and substitutes the normal Location header with an internal x-nextjs-redirect header. Browsers ignore the x-nextjs-redirect header, so the redirect becomes unusable. This vulnerability, classified as CWE-349, effectively breaks the redirect mechanism for legitimate requests.

The issue afflicts vercel:next.js from version 12.2.0 up to, but not including, 15.5.16 and 16.2.5. Upgrading to version 15.5.16 or 16.2.5—or any newer release—removes the flaw.

With a CVSS score of 3.7, the vulnerability is of low severity. The server side error can be triggered by any external client who can craft a request with the x-nextjs-data header; no authentication is required. An attacker can poison cached 3xx responses on a CDN or reverse proxy that does not vary on this header, causing downstream visitors to receive a redirect lacking a Location header until the cache expires or is purged. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog.