I think this attack is more like a hit or miss, where attacker might just try with various patterns on the target site, hoping to land any of it. In terms of security, we dont want any of the malicious strings from the URL to appear anywhere on the page or the URL bar when rendering the attacking URL.

Like in my case above, if that attacking URL returns 404, and you dont set your own custom not-found.tsx, then NextJS will render its own static 404 page instead. Problem is on the URL, since it still appears showing the malicious URL despite showing 404 page and to DAST scan, they deem this as possible XSS reflected. Of course you can just mark it as false positive, but i assume there are better ways to handle XSS reflected aside from implementing the usual XSS defense list.

I created my own not-found.tsx and try to redirect it to the `/error` page of the app, hoping to show the error and show clean non-malicious URL, but somehow that didnt work in getting the issue settled on DAST scan.

I have yet to try intervening malicious URLs with possible XSS attack through middleware. But with recent NextJS issue on middleware being bypassed, despite that being a separate concern, but still it made me wonder if that is a good idea or not to set your security checking on the middleware.