Replies: 16 comments 27 replies
|
Also. the action name is "x" not a random id like other issues. and I can't replicate this in dev envrionment or manually triggering action on production. This just happens randomly at some point. I am self hosting on a vps with docker |
|
I got it after updating to 16.0.10 |
|
same issue, start getting it today |
|
Same issue, we started encountering it last week too, Next 15.2.8 + fix from nextjs.org/docs/messages/failed-to-find-server-action. |
|
On 16.1.1 and facing the same issue |
This doesn't fix the issue for me. i am still getting same issue even after updating process.env.NEXT_SERVER_ACTIONS_ENCRYPTION_KEY |
|
Yep, just got this as well. Application went down with timeouts (no crash, just infinite loading) accompanied by a spam of that log. Running on 15.1.9. Here's our full log: |
|
https://nextjs.org/docs/messages/failed-to-find-server-action works for next 16.1.1 |
|
doesn't work for me :( |
|
@DaywisonSilva didn't work what I expected for me too, but at least it's not crashing anymore, it just logs the error and keeps running, idk how safe it is 😞 |
|
@07CalC Do you mean that the failed to find server action ‘x’ error still is logged but your app runs fine? |
|
@jrig95 yes, previously the app was crashing after this error (server side error), but after upgrading next js to 16.x.x and using this method prevents the app from crashing but error is still there |
|
@07CalC Same scenario for us as well. Doesn’t seem to be impacting anything but also no sure how safe it is. Hopefully vercel acknowledges this. |
|
The same issue occurs in version 14.2.35. The server doesn't crash, but CPU usage spikes to 100%. |
|
got this as well |
|
If you're getting spammed with this error message on an app that is accessible externally, it's likely attackers looking for app deployments that are still vulnerable to the recent For OP, I'm not sure about the "original error" part, or why your server subsequently crashes - did you upgrade to a safe version of next? |
|
We updated nextjs to 16.1.1 after a react2shell incident. Since then, on one nextjs app, the page goes into a reloading loop, 3 to 10 reloads, sometimes more. The logs are full of Failed to find Server Action "x". Mismatching ids of server actions are known to cause page reloading, so I'm assuming for the moment that the log errors and the reloading share a common cause. |
|
I have personally tried all possible fixes but still have the issue. I am personally contemplating to never use nextjs at all after this. every upgrade breaks things. i tried older versions and newer version nothing changes. and react2shell issue as well nothing changes |
|
Ok I think we're out of the woods. The page reloading loop was related to the nextjs upgrade. The fast fix was to downgrade to a (patched) v15. The failed to find server action is not impacting the user experience. We'll keep watching it but our app is working. |
|
I have been getting these error logs in production as well. The confusing part is that I'm not using server actions at all in my codebase. I've already reviewed the documentation here: https://nextjs.org/docs/messages/failed-to-find-server-action, but I can't wrap my head around why I'm seeing this error. |
|
any solution for this? Error: Failed to find Server Action "x". This request might be from an older or newer deployment. |
|
Same here This happening only in prod (coolify), i guess. |
|
In our recent experience, Failed to find Server Action "x" will not put your CPU at 100%, but cryptomining crap arriving via react2shell will. Look carefully at what's running on your box. |
|
Been having this error for the past month as well. Recently massively increased, I assume from attackers trying to test react2shell exploit. Still, extremely annoying to not have a way of dealing with this error. At the very least I wish they would change it to a warning, which it seems to have previously been. |
|
Maybe it's not a discussion anymore but really an issue? I think so! |
|
It definitely is. I am so tired of this issue now. Recently my entire server got attacked using React2Shell Vulnerability and Injected some malicious invisible payloads to mine crypto and camo all this so I can't see and for some time i didn't even open logs for a month but then i saw all this. They attacked one Docker container and gained shell access there and moved laterally to entire compose cluster and then my entire server through that. Eventually i had to delete the server that gave my 6 months time to. and now started a new server and it worked wel for 1 day and again started throwing these errors. I'm a Technical Founder and it feels so exhausting now after trying everything they recommended but nothing works. planning on moving away from nextjs entirely tbh.I |
|
Same issue here. Next 14.2.20". The server doesn't crash but creates noisy logs "Error: Failed to find Server Action "x". This request might be from an older or newer deployment. Original error: Cannot read properties of undefined (reading 'workers')". Server CleverCloud. |
|
Having the same issue with Next 15.0.7 deployed with Azure Web App Service, and I don't even use Server Actions or any API routes except a healthcheck route that always returns an OK response. This log shows up constantly when viewing the log stream on Azure, but the website works normally. Seems like it's just attackers trying to spam the react2shell exploit. Would be nice if there is a way to just ignore these logs. |
|
Is there a solution to this? Our app is now broken in production (running in a normal docker multi-replica cluster). It is serving wrong data too. I noticed that components no longer get cached on the remote redis cache we use , only functions are cached. It places components (pages and layouts) on disk, in the @icyJoseph Could you please chime in, this is a bit of a crisis for us. Thank you very much for the help! PS: I did follow this https://nextjs.org/docs/messages/failed-to-find-server-action , so that env is in the containers. |
|
Thanks for the writeup. We already use a build id based on the git hash (see below), but this did not solve it for us. Still getting thre error. Parsing the error as you did, feels a bit too brittle for my taste. /**
* - By default, Next.js uses unique ID per build,
* which will differ between builds in preview and production.
* - Set build ID to git commit hash, which ensures same build ID
* when repo is built from same codebase, i.e. preview then production.
* - Helps with:
* - Cache busting for static assets.
* - Tracking which version is deployed
* - Ensuring consistent builds across multiple containers? why?
*/
generateBuildId: async () => {
if (process.env['GIT_HASH']) {
return process.env['GIT_HASH'];
}
/**
* Try to get git hash if not provided via env.
*/
try {
const { execSync } = await import('node:child_process');
return execSync('git rev-parse HEAD').toString().trim();
} catch {
/**
* Fallback for non-git environments.
*/
return `build-${Date.now()}`;
}
}, |
|
Can we get this error in logs even if we aren't using Server Actions explicitly anywhere the codebase? |
|
What fixed it for me was to enable that environment variable to in build time, not only in runtime. |
Can u provide more details on "how". I would like to replicate your steps exactly and verify if it is a 'luck' or really a solution. |
Yeah, if you are using coolify, there is an checkbox to have them in build time and another for runtime.you need to select both. For Dockerfile, if you want available in build time you need to set it there |
|
We are getting thousands of these log messages on our severs each day, @icyJoseph . They are clogging up the servers, making debugging difficult and eventually leading to crashes. Could you please let us know if it is OK and safe to block all requests where Next-Action header value is "x", or is shorter than for instance 10 characters (since the server actions should be long-form hashes)? UPDATE: FIX As noted above, we noticed bots probing our Next.js app by sending POST requests with short or garbage next-action header values, like These hit the server, get processed by Next.js, and return errors, wasting resources and polluting logs. The below fix seems to work so far. The fix has two layers:
In case useful to others, below is a summary. Layer 1: Cloud Firewall The cloud firewall only exposes HTTP/HTTPS on the reverse proxy, as such the application servers are not directly reachable from the internet. The application servers expose their app port (e.g. 3000) only on the private network. Layer 2: Reverse Proxy: Block Malformed Server Actions Valid Next.js server action IDs are hash-based (40+ hex characters). Bot probes are almost always very short strings. Thus, we block them at the reverse proxy before they reach the app. Caddy example: This rule:
Result
So far so good, let's see how it plays out. |
|
Thanks @magnusriga! For For anyone using Traefik instead of caddy, you can use this router rule (replace with your domain): |
|
Thank you! That worked for me as well. I'm using nginx and this is the config that worked for me. |
|
FYI: I ended up increasing the char length to 15 to get rid of all spam on our deployment. |
|
Based on the thread, there are two separate causes for this error — it helps to identify which one you're hitting: Cause 1: Bots probing for the
|
| Error shows | Cause | Fix |
|---|---|---|
"x", "test", short strings |
Bot probing react2shell | Block at reverse proxy |
| Long hex hashes, multiple containers | Mismatched encryption keys | Set NEXT_SERVER_ACTIONS_ENCRYPTION_KEY at build + runtime |
| Random, affects all actions | Key set only at runtime | Re-set key at build time too |
and others
Uh oh!
There was an error while loading. Please reload this page.
Summary
in production I keep getting
"[Error: Failed to find Server Action "x". This request might be from an older or newer deployment. Original error: Cannot read properties of undefined (reading 'workers')]"
which then completely destorys backend of the app then users can't even login or logout or perform any other actions.
when i rebuild the project and it passes the ci/cd and deploys it for some time works without problems then in couple of hors this happens randomly. I haven't been able to find anything related to this as well. anyone have any idea how to solve this?
Additional information
Example
No response
All reactions