nextjs - 💡(How to fix) Fix App Router component chunk scripts are missing CSP nonce

Link to the code that reproduces this issue

I can provide a minimal reproduction if needed. We found this while debugging CSP report-only violations in a Next.js 16.1.6 App Router app.

To Reproduce

1. Use App Router with CSP nonces as documented:
   • generate a per-request nonce in proxy/middleware
   • pass it through x-nonce
   • pass a request Content-Security-Policy header containing 'nonce-...'
   • set the same nonce in the response CSP
2. Render a route that causes App Router to emit component JS chunks.
3. Inspect the SSR HTML or CSP reports.

Current vs. Expected behavior

Current:

Some SSR-emitted component chunk scripts are rendered without a nonce:

<script src="/_next/static/chunks/..." async=""></script>

This causes CSP violations under script-src-elem when using a strict nonce-based policy.

Expected:

Those scripts should include the nonce parsed by Next from the request CSP:

<script src="/_next/static/chunks/..." async="" nonce="..."></script>

Suspected source

packages/next/src/server/app-render/create-component-styles-and-scripts.tsx

This currently emits:

createElement('script', {
  src: `${ctx.assetPrefix}/_next/${encodeURIPath(href)}${getAssetQueryString(ctx, true)}`,
  async: true,
  key: `script-${scriptIndex}`,
})

It should likely mirror packages/next/src/server/app-render/get-layer-assets.tsx, which already passes:

nonce: ctx.nonce

Related context

This seems similar in class to previously fixed CSP nonce propagation gaps, for example #81999, but that patch covers next/dynamic preload chunks. This issue appears to be a separate App Router SSR component chunk script path.