nextjs - 💡(How to fix) Fix Server Actions receive empty FormData after upgrading to 16.2.6 (security release regression)

Link to the code that reproduces this issue

https://github.com/Poolshark/next-16.2.6-server-action-issue

To Reproduce

1. Start application
2. Click submit button
3. Check server logs

Any form using useActionState + a server action with "use server" receives an empty FormData {} on the server side. All form inputs are present in the DOM at submission time.

Current vs. Expected behavior

Current Behaviour

Submitting a form value via useActionState should result in te formData present in the corresponding action. Instead the action receives FormData {}.

 GET / 200 in 172ms (next.js: 93ms, application-code: 79ms)
FormData entries: {}
test-field value: null
 POST / 200 in 26ms (next.js: 5ms, application-code: 21ms)
  └─ ƒ testAction(null, {}) in 3ms app/testAction.ts

Expected Behaviour

FormData should be present.

Provide environment information

npm: 11.9.0
  Yarn: N/A
  pnpm: 11.0.9
Relevant Packages:
  next: 16.2.6 // Latest available version is detected (16.2.6).
  eslint-config-next: N/A
  react: 19.2.6
  react-dom: 19.2.6
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Server Actions

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local), Vercel (Deployed)

Additional context

Likely: The DoS fix for CVE-2026-23870 in react-server-dom-turbopack changed how request payloads are deserialised for Server Functions, and appears to drop FormData entries.

The problem does NOT appear in [email protected] and next@canary!