From 1419c1d9ee0eeace274aad515c33759a129ff186 Mon Sep 17 00:00:00 2001
From: Amritanshu <git@tanshu.com>
Date: Sat, 12 Sep 2026 16:17:25 +0530
Subject: [PATCH] Reject Next-Action probes before the SSR handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

POST / with a React server-actions header is not a request this app
makes — TanStack server functions POST to /_serverFn/<id>. Left alone
the transform stream sat open until the 120s lifetime timer force-cleaned
it, surfacing as a fatal uncaught exception in Sentry (event e267e264,
release 84dffa8). Now answered 404 in 9ms; normal pages unaffected.
---
 server.mjs | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/server.mjs b/server.mjs
index e717c9f..5716382 100644
--- a/server.mjs
+++ b/server.mjs
@@ -137,6 +137,16 @@ async function toWebRequest(req, url) {
 }
 
 async function sendFromHandler(req, res) {
+  // TanStack server functions POST to /_serverFn/<id>; a POST carrying the
+  // React server-actions header anywhere else is a probe (bots love
+  // `Next-Action: x`). Left alone it ties up an SSR stream until the 120s
+  // lifetime timer force-cleans it and Sentry reports a fatal uncaught
+  // exception — so reject it before the handler ever sees it.
+  if (req.headers["next-action"] !== undefined) {
+    res.writeHead(404, { "content-type": "text/plain" });
+    res.end("not found");
+    return;
+  }
   const url = `http://${req.headers.host ?? `${HOST}:${PORT}`}${req.url}`;
   const request = await toWebRequest(req, url);
   const response = await handler.fetch(request);