X-Content-Type-Options: nosniff is set

MIME-sniffing is the browser behavior where, if a server sends a response with a wrong or ambiguous Content-Type, the browser guesses what the content actually is and renders it accordingly. An attacker who can upload a file that looks like a script — even if it's served as text/plain — can trigger script execution if MIME-sniffing is allowed. CWE-430 (Deployment of Wrong Handler) and CWE-436 (Interpretation Conflict) both map to this class of confusion attack. The nosniff directive costs nothing to deploy and closes a class of content-confusion exploits that bypass file type restrictions on upload endpoints.

Add X-Content-Type-Options: nosniff to your global header configuration. This is a zero-configuration, zero-compatibility-risk fix.

// next.config.js
headers: [{
  key: 'X-Content-Type-Options',
  value: 'nosniff'
}]

If you use Express, helmet() sets this automatically. For other frameworks, add the header in your response middleware. The value must be exactly nosniff — no other values are recognized by browsers.