Stored XSS in Next.js App Router CSP nonce parsing

CVE-2026-44581 affects Next.js App Router applications in versions 13.4.0 through before 15.5.16 and 16.2.5 when those applications rely on CSP nonces and are deployed behind shared caches. In affected versions, malformed nonce values derived from request headers can be reflected into rendered HTML without sufficient sanitization. This creates an unsafe HTML injection condition in nonce handling, allowing an attacker to poison a cache with a maliciously crafted response. Subsequent users served the poisoned cached response can then execute attacker-controlled script in their browsers. The issue is described as a CSP nonce parsing edge case and results in stored cross-site scripting via cache poisoning.