Zero‑click SXSS via header reflection in Next.js cache
Researchers discovered that mirroring request headers into response headers enables a reliable zero‑click cross‑site scripting attack on recent Next.js versions. By forcing the App Router to treat a request as HTML, attackers can inject payloads through reflected URL parameters, bypassing typical defenses.