Next.js, a React framework, embeds untrusted data into beforeInteractive scripts without proper escaping. The vulnerability, classified as CWE‑79, allows an attacker to inject JavaScript that runs in the victim’s browser when the script content is parsed. This can lead to session hijacking, credential theft, or execution of arbitrary client‑side code.

Vercel's Next.js framework. Affected releases include all versions from 13.0.0 through 15.5.15 and every 16.x release prior to 16.2.5, as the fix is incorporated in Next.js 15.5.16 and 16.2.5.

The CVSS score of 6.1 indicates a moderate severity, and there is no EPSS data available, so the likelihood of widespread exploitation is uncertain. The vulnerability can be exploited by inserting attacker‑controlled content into a beforeInteractive script that is later rendered to the page, a scenario that is feasible in typical SSR or S deployments. The reported KEV status indicates it has not yet been cataloged by CISA; however, the nature of the flaw means any vulnerable site that renders untrusted content is at risk of XSS in user browsers.