Next.js versions from 13.4.0 up to just before 15.5.16 and 16.2.5 allow malformed CSP nonces derived from request headers to be rendered unsafely in application pages. An attacker can exploit the reflected nonce to store malicious script payloads in shared cache entries, leading to script execution for subsequent users viewing the cached content.

Vercel's Next.js framework, specifically App Router applications running version 13.4.0 through 15.5.15 and version 16.2.4. Users of these releases should check that their project dependencies reference one of the fixed versions.

The CVSS score of 4.7 indicates a low risk rating, and EPSS data is not available, so native exploitation likelihood cannot be quantified. The vulnerability is not in the CISA KEV catalog. It requires deployment behind a shared cache and reliable reflection of nonce values; the attacker can poison cache entries and cause arbitrary script execution for later visitors. Because the flaw is a stored cross‑site scripting issue, once the malicious nonce is cached it impacts all users who receive the cached response.