Boundary scripts missing CSP nonce

“Suggested fix: add nonce: ctx.nonce to the createElement('script', …) call in create-component-styles-and-scripts, mirroring get-layer-assets.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/next-js/issues/4334/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Boundary chunk script tags emitted without CSP nonce. In App Router SSR, loading, not-found, error or template boundary scripts lack nonce and are blocked under strict-dynamic CSP.

Is this your bug?

File my report

Where: App Router SSR
Versions: 16.3.3
Platforms: Windows
How bad: Breaks a normal workflow.

Not quite your bug?

Original reports2, newest first

Aug 28, 2026App Router: boundary (loading/template/error) chunk <script> is emitted without the CSP nonceOn GitHub#98015
Aug 25, 2026App Router: boundary (loading/not-found/error) chunk <script> tags are emitted without the CSP nonce (createComponentStylesAndScripts vs getLayerAssets)On GitHub#97882

Boundary scripts missing CSP nonce

Is this your bug? What gets counted gets fixed. Pile on.

Is this your bug?

Not quite your bug?

Original reports2, newest first

Do you work on Next.js?