Next.js versions 12.2.0 to before 15.5.16 and 16.0.0 to before 16.2.5 contain a vulnerability where an external client can send a x-nextjs-data header on requests to middleware-handled redirect paths. This causes the middleware or proxy to treat the request as a data request and replace the standard Location redirect header with an internal x-nextjs-redirect header. Browsers do not recognize x-nextjs-redirect, resulting in unusable redirects. When deployed behind caching CDNs or reverse proxies that do not vary cache entries based on this header, an attacker can poison the cached redirect response. This leads to denial of service for users accessing the affected redirect path until cache expiration or purging. The vulnerability is addressed in Next.js versions 15.5.16 and 16.2.5.

An attacker can cause denial of service on specific redirect paths by poisoning cached redirect responses in CDNs or reverse proxies that do not vary cache entries by the x-nextjs-data header. This results in subsequent users receiving redirect responses without a valid Location header, making the redirect unusable until the cache entry expires or is purged. There is no direct confidentiality or integrity impact reported.

This vulnerability is fixed in Next.js versions 15.5.16 and 16.2.5. Users should upgrade to at least these versions to remediate the issue. If upgrading immediately is not possible, ensure that caching CDNs or reverse proxies vary cache entries based on the x-nextjs-data header or disable caching of 3xx redirect responses on affected paths to prevent cache poisoning. Patch status is not explicitly stated as 'official-fix' in the vendor advisory, but the fixed versions are clearly identified. Check the Next.js official release notes for confirmation and additional guidance.