fix(proxy): reject malformed server-action requests to reduce CPU spikes

src/proxy.ts

@@ -19,6 +19,14 @@ const SECURITY_HEADERS: Record<string, string> = {
 };
 
 export const proxy = async (req: import("next/server").NextRequest) => {
+	// Server actions carry an opaque action id in this header. A malformed or
+	// trivially short id (e.g. "x" sent by bots) can never resolve to a real
+	// action; rejecting it here avoids the expensive lookup/render path.
+	const nextAction = req.headers.get("next-action");
+	if (nextAction && !/^[A-Za-z0-9_-]{8,}$/.test(nextAction)) {
+		return new NextResponse(null, { status: 400 });
+	}
+
 	const decision = await enforceDdosRateLimit(req);
 	if (decision.outcome === "suspect") {
 		return ddosReject(403);