500 errors when sending OPTIONS request to _next/static/chunks/...

Why this is a good first issue

Handling OPTIONS requests incorrectly leads to 500 errors.

AI Summary

The issue involves incorrect handling of OPTIONS requests to static chunks, resulting in 500 errors instead of appropriate 4XX responses. This affects production environments and logs. The fix requires modifying request handling logic but the exact scope and impact are not fully clear.

Issue Description

Link to the code that reproduces this issue

https://github.com/djalabs/nextjs-reproduction-app

To Reproduce

Start the application in production mode (npm run build && npm run start) Open localhost:3000 and filter network tab of dev console for _next/static/chunks Send OPTIONS request to one of those URLs instead of GET and note that you get a 500 error

Current vs. Expected behavior

500 errors should always be considered a bug somewhere in the code, as potentially malicious or broken clients should not be able to trigger them arbitrarily. Currently it is polluting our HTTP logs with noise and makes up the almost all of our 500 errors in production.

OPTIONS request should really be handled without any error, but if an error must be given then 405 or something else in the 4XX range would be much less frustrating.

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Home
  Available memory (MB): 32190
  Available CPU cores: 16
Binaries:
  Node: 22.14.0
  npm: 10.9.2
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 16.2.1-canary.14 // Latest available version is detected (16.2.1-canary.14).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A

Note that the same issue occurs on our GCP cloud run production instance

Which area(s) are affected? (Select all that apply)

Route Handlers, create-next-app, Output, Metadata, Headers

Which stage(s) are affected? (Select all that apply)

Other (Deployed), next start (local)

Additional context

Wasn't really sure what to put for areas affected, but basically just about all nextjs instances out in the wild can be tricked into 500-ing, and we have seen that certain questionable bots will do this automatically, whether intentional or not.

Initially created with direct link to reproduction template within nextjs, since no code changes needed to reproduce this error, but bot d

GitHub Labels

create-next-appOutputMetadataRoute HandlersHeaders