From a878d831aa804d84576ee14fb2ae757c5b635420 Mon Sep 17 00:00:00 2001
From: openhands <openhands@all-hands.dev>
Date: Thu, 22 Oct 2026 21:46:55 +0200
Subject: [PATCH] fix(proxy): reject malformed server-action requests to reduce
 CPU spikes

---
 src/proxy.ts | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/proxy.ts b/src/proxy.ts
index 75b538f7..50055848 100644
--- a/src/proxy.ts
+++ b/src/proxy.ts
@@ -19,6 +19,14 @@ const SECURITY_HEADERS: Record<string, string> = {
 };
 
 export const proxy = async (req: import("next/server").NextRequest) => {
+	// Server actions carry an opaque action id in this header. A malformed or
+	// trivially short id (e.g. "x" sent by bots) can never resolve to a real
+	// action; rejecting it here avoids the expensive lookup/render path.
+	const nextAction = req.headers.get("next-action");
+	if (nextAction && !/^[A-Za-z0-9_-]{8,}$/.test(nextAction)) {
+		return new NextResponse(null, { status: 400 });
+	}
+
 	const decision = await enforceDdosRateLimit(req);
 	if (decision.outcome === "suspect") {
 		return ddosReject(403);