Next.js CSP-nonce reflected XSS (CVE-2026-44581)

GET with Content-Security-Policy: script-src 'nonce-' where the payload uses a TAB as separator so the legacy nonce parser accepts it; reflected nonce must not be attribute-escaped ' where the payload uses a TAB " "as separator so the legacy nonce parser accepts it; reflected nonce must not be "...