Summary

The x-nextjs-request-id request header value is embedded into an inline <script> bootstrap tag in development server mode using JSON.stringify() without HTML escaping. Because JSON.stringify does not escape </script>, an attacker with network access to the dev server can break out of the script tag and execute arbitrary JavaScript.

This is the same class of bug that was fixed in stream-ops.node.ts and use-flight-response.tsx by the recent GHSA security patch (commit 647d923a3f), but the bootstrapScriptContent assignment in app-render.tsx was missed.

Affected file

packages/next/src/server/app-render/app-render.tsx — renderToStream function

// Current code (vulnerable)
const bootstrapScriptContent = process.env.__NEXT_DEV_SERVER
  ? `self.__next_r=${JSON.stringify(requestId ?? crypto.randomUUID())}`
  : undefined

requestId is read directly from the x-nextjs-request-id header, which is not in the INTERNAL_HEADERS strip-list.

Proof of concept

Send the following request to a running dev server:

GET / HTTP/1.1
Host: localhost:3000
X-Nextjs-Request-Id: 0</script><img src=x onerror=alert(origin)>

The server renders:

<script>self.__next_r="0</script><img src=x onerror=alert(origin)>"</script>

The HTML parser closes <script> at the first </script>, then fires the onerror handler.

Impact

• Scope: Development server only (process.env.__NEXT_DEV_SERVER). Production builds are not affected.
• Risk in practice: Elevated in cloud dev environments (GitHub Codespaces, Gitpod) where the port is publicly accessible under a *.github.dev or *.gitpod.io origin — stealing cookies/tokens from that origin.

Fix

Wrap with htmlEscapeJsonString, consistent with the existing fix applied to the two other locations in the GHSA patch:

- ? `self.__next_r=${JSON.stringify(requestId ?? crypto.randomUUID())}`
+ ? `self.__next_r=${htmlEscapeJsonString(JSON.stringify(requestId ?? crypto.randomUUID()))}`

A fix with a regression test is available in this PR: https://github.com/tomohiro86/next.js/pull/new/fix/dev-mode-xss-bootstrap-script-content

Related

• GHSA cherry-pick commit that fixed the same pattern in two other files: 647d923a3f
• packages/next/src/server/app-render/stream-ops.node.ts (fixed)
• packages/next/src/server/app-render/use-flight-response.tsx (fixed)