Next.js x-nextjs-data Redirect Cache Poisoning

A cache poisoning vulnerability in Next.js affects versions 12.2.0 through before 15.5.16 and 16.2.5. An external client can send the x-nextjs-data header on an otherwise normal request to a path handled by middleware that returns a redirect. In the vulnerable logic, the middleware/proxy may incorrectly treat that request as an internal data request and replace the normal HTTP Location redirect header with the internal x-nextjs-redirect header. Because standard browsers do not follow x-nextjs-redirect, the resulting response is not a usable redirect for normal clients. When the application is deployed behind a CDN or reverse proxy that caches 3xx responses without varying on the x-nextjs-data header, this behavior allows a malicious request to poison the cached redirect response for the affected path.