Spot the bug in the CSP nonce middleware

import { randomBytes } from 'node:crypto';

const nonce = randomBytes(16).toString('base64');

function addCsp(request, response, next) {
  response.locals.nonce = nonce;
  response.setHeader(
    'Content-Security-Policy',
    `default-src 'self'; script-src 'nonce-${nonce}'`,
  );
  next();
}