Manifest files (maybe others?) loaded via script tags with non-JavaScript content types

Link to the code that reproduces this issue

https://github.com/stuartkeith/next-header-reproduction

To Reproduce

Run the server and check the console - you will see (index):1 Refused to execute script from 'http://localhost:3000/_next/static/development/_clientMiddlewareManifest.js' because its MIME type ('application/json') is not executable, and strict MIME type checking is enabled.

Current vs. Expected behavior

In Chrome (and maybe other browsers), "strict MIME type checking" can come into play - for me, I was adding a X-Content-Type-Options: nosniff header. The docs recommend setting this.

This causes Chrome to be stricter about content types. It will then not execute the _clientMiddlewareManifest.js script (and maybe others?), because the content type is application/json; charset=utf-8. Because it's loaded via a script tag, it's expected the file's content type is JavaScript, not JSON.

I think the expected behaviour would be for the script tag to be text/javascript, so the script executes.

I did work around this issue by just not setting the X-Content-Type-Options: nosniff header for NODE_ENV=development.

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 24.6.0: Fri Feb 27 19:31:41 PST 2026; root:xnu-11417.140.69.709.8~1/RELEASE_ARM64_T6000
  Available memory (MB): 16384
  Available CPU cores: 8
Binaries:
  Node: 24.14.0
  npm: 11.9.0
  Yarn: N/A
  pnpm: 10.3.0
Relevant Packages:
  next: 16.2.1-canary.16 // Latest available version is detected (16.2.1-canary.16).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

This is new in Next 16.2.x. I can see there is a constant for the content type used in a few places, so this might apply in other scenarios too.

Start with the linked reproduction repository and run the development server to confirm the MIME-type error for _clientMiddlewareManifest.js. Search the Next.js development-server code for the content-type constant mentioned in the issue and trace how manifest files are emitted and referenced by script tags. Done means affected script-loaded manifests receive a JavaScript content type without breaking other manifest responses.