PR #90101: fix: return 404 instead of 500 for multipart POST without server action

• Repository: vercel/next.js
• Author: sleitor
• State: open | merged: False
• Link: https://github.com/vercel/next.js/pull/90101

Description (problem / solution / changelog)

What?

When a POST request with multipart/form-data content type is sent to a route that has server actions, but the request itself doesn't contain valid action IDs in the form data, the server returns a 500 error instead of the expected 404.

Why?

The action handler treats any multipart POST as a potential MPA server action. When areAllActionIdsValid() returns false (no valid action IDs in form data), it throws an error:

Failed to find Server Action. This request might be from an older or newer deployment.

This results in a 500 response. However, if there are no valid action IDs in the form data, the request was never intended to be a server action — it's just a regular multipart POST to a non-existent route (or a route that doesn't handle POST).

The existing TODO comments on both code paths acknowledged this:

// TODO: This can be from skew or manipulated input. We should handle this case more gracefully

How?

Changed both the Edge and Node.js runtime paths to return null instead of throwing when areAllActionIdsValid() returns false. Returning null from the action handler lets normal routing take over, which correctly returns 404.

This is consistent with the existing behavior a few lines below, where decodeAction returns a non-function:

} else {
  // We couldn't decode an action, so this POST request turned out not to be a server action request.
  return null
}

Fixes #90090

• Related issues linked using fixes #number
• Tests not needed (behavior change is from 500 → 404 for non-action requests; existing MPA action tests cover the action paths)

Changed files

• packages/next/src/server/app-render/action-handler.ts (modified, +6/-10)
• test/e2e/app-dir/actions-unrecognized/actions-unrecognized.test.ts (modified, +6/-32)

PR #91129: Fix POST with form data returning 500 instead of 404

• Repository: vercel/next.js
• Author: mvanhorn
• State: open | merged: False
• Link: https://github.com/vercel/next.js/pull/91129

Description (problem / solution / changelog)

Summary

• When a multipart/form-data POST request is sent to a route that doesn't have a server action, Next.js returns a 500 error instead of 404
• The root cause is in action-handler.ts: when areAllActionIdsValid() returns false for a non-fetch multipart POST, the handler throws an error instead of returning null to fall through to normal routing
• Changed both occurrences (Web API path and Node.js streaming path) to return null instead of throwing, allowing normal 404 routing to occur

Fixes #90090

Test plan

• Added e2e test test/e2e/app-dir/post-formdata-404/ that verifies:
  • POST with multipart/form-data to a non-existent route returns 404
  • POST with multipart/form-data to an existing route without server actions returns 404

This contribution was developed with AI assistance (Claude Code).

Changed files

• packages/next/src/server/app-render/action-handler.ts (modified, +6/-10)
• test/e2e/app-dir/post-formdata-404/app/layout.tsx (added, +11/-0)
• test/e2e/app-dir/post-formdata-404/app/page.tsx (added, +3/-0)
• test/e2e/app-dir/post-formdata-404/app/with-action/page.tsx (added, +10/-0)
• test/e2e/app-dir/post-formdata-404/next.config.js (added, +2/-0)
• test/e2e/app-dir/post-formdata-404/post-formdata-404.test.ts (added, +31/-0)