Next.js routes respond with 200 to unsupported HTTP methods

[ppiwo]

Link to the code that reproduces this issue

https://codesandbox.io/p/sandbox/github/vercel/next.js/tree/canary/examples/reproduction-template

To Reproduce

1. Open codesandbox
2. Copy Preview URL
3. Using your tool of choice, make any non GET request (POST, PATCH, DELETE, etc)

Current vs. Expected behavior

Current:

• 200 response, with HTML document matching the GET route
• Client side error once JS loads

Application error: a client-side exception has occurred while loading (see the browser console for more information).

Expected:
405 - Method not allowed

Provide environment information

Operating System:
      Platform: darwin
      Arch: arm64
      Version: Darwin Kernel Version 23.0.0: Fri Sep 15 14:41:43 PDT 2023; root:xnu-10002.1.13~1/RELEASE_ARM64_T6000
    Binaries:
      Node: 20.9.0
      npm: 10.1.0
      Yarn: 3.5.0
      pnpm: 10.5.2
    Relevant Packages:
      next: 13.4.19
      eslint-config-next: 15.3.0
      react: 18.3.1
      react-dom: 18.3.1
      typescript: 5.8.3
    Next.js Config:
      output: N/A

Which area(s) are affected? (Select all that apply)

Not sure

Which stage(s) are affected? (Select all that apply)

Vercel (Deployed), next start (local), next dev (local), next build (local), Other (Deployed)

Additional context

I've tested this both self hosted and on Vercel, with 200's on each. The next.js website returns a 405 as expected.

[wyattjoh]

If you have a page.tsx at the same level as a route.ts, they actually conflict.

[ppiwo]

If you have a page.tsx at the same level as a route.ts, they actually conflict.

@wyattjoh have you tested the repro? There is only a page.tsx and a 200 is returned for POST.

[github-actions]

This closed issue has been automatically locked because it had no new activity for 2 weeks. If you are running into a similar issue, please create a new issue with the steps to reproduce. Thank you.

[elbajo]

Investigated this a bit. Adding detailed reproduction steps below to help with debugging.

TL;DR & Why this matters

What's happening?

Next.js returns a 200 with the GET response for some POST requests and bypasses the GET cache. This is unexpected, Next.js should return 405. The behavior is different depending on the type of POST request and the hosting environment.
This is happening on endpoints with a page.tsx and no route.tsx.

Dev mode, locally hosted

[JSON POST] -> 200 [UNEXPECTED, should be 405]
[Form Data POST] -> 200 [UNEXPECTED, should be 405]
[Multipart Form Data POST] -> 200, cached bypassed [UNEXPECTED, should be 405]

Prod mode, locally hosted

[JSON POST] -> 405 [Expected]
[Form Data POST] -> 200 [UNEXPECTED, should be 405]
[Multipart Form Data POST] -> 200 [UNEXPECTED, should be 405]

Prod mode, Vercel hosted

[JSON POST] -> 405 [Expected]
[Form Data POST] -> 405 [Expected]
[Multipart Form Data POST] -> 200, cached bypassed [UNEXPECTED, should be 405]

Why do we care?

This does not appear to be a direct security issue, since the response is just the GET content. The issue is that the cache for GET routes is bypassed on Vercel hosted instances when using a Multipart POST. This results in extra CPU usage and higher hosting costs. Overall, this behavior is confusing and should be fixed regardless.
I see this on my own website where bots are hitting a page in credential stuffing attempts (high traffic). The page doesn’t have a POST endpoint, so those requests should just return 405. Instead we return the full HTML and the cache is bypassed.

CURL commands used for testing

JSON POST

curl -iX POST http://localhost:3000 \
  -H "Content-Type: application/json" \
  -d '{"message": "Testing json POST"}'

Form Data POST

curl -iX POST http://localhost:3000 \
  -d 'message=Testing form data POST'

Multipart Form Data POST

curl -iX POST http://localhost:3000 \
  -F 'payload={"message":"Testing multipart form data POST"}'

Local demo (Next.js 15.5.3) in dev mode

Form Data POST, JSON POST and Multipart Form Data POST -> 200 with HTML from GET [UNEXPECTED, should be 405]

HTTP/1.1 200 OK
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
link: </_next/static/media/797e433ab948586e-s.p.dbea232f.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/caa3a2e1cccd8315-s.p.853070df.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </next.svg>; rel=preload; as="image"
Cache-Control: no-store, must-revalidate
X-Powered-By: Next.js
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Sep 2025 14:09:44 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

<!DOCTYPE html><html lang...

Local demo (Next.js 15.5.3) in prod mode

JSON POST -> 405 [Expected]

HTTP/1.1 405 Method Not Allowed
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
Allow: GET
Allow: HEAD
Date: Wed, 17 Sep 2025 14:12:11 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

Method Not Allowed

Multipart Form Data POST and Form Data POST -> 200 with HTML from GET [UNEXPECTED, should be 405]

HTTP/1.1 200 OK
Vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch, Accept-Encoding
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
link: </_next/static/media/797e433ab948586e-s.p.dbea232f.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </_next/static/media/caa3a2e1cccd8315-s.p.853070df.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </next.svg>; rel=preload; as="image"
x-nextjs-cache: HIT
x-nextjs-prerender: 1
X-Powered-By: Next.js
Content-Type: text/html; charset=utf-8
Date: Wed, 17 Sep 2025 14:12:45 GMT
Connection: keep-alive
Keep-Alive: timeout=5
Transfer-Encoding: chunked

<!DOCTYPE html><html lang="

Vercel hosted (Next.js 15.5.3)

JSON POST and Form Data POST -> 405 [Expected]

HTTP/2 405
age: 45202
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-type: text/html; charset=utf-8
date: Wed, 17 Sep 2025 14:15:53 GMT
server: Vercel
strict-transport-security: max-age=63072000
x-matched-path: /
x-vercel-cache: HIT
content-length: 0

Multipart Form Data -> 200 with HTML from GET (Cache is bypassed) [UNEXPECTED, should be 405]

HTTP/2 200
age: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-type: text/html; charset=utf-8
date: Wed, 17 Sep 2025 14:14:23 GMT
link: </_next/static/media/7b0b24f36b1a6d0b-s.p.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2"
server: Vercel
strict-transport-security: max-age=63072000
x-matched-path: /
x-nextjs-prerender: 1
x-powered-by: Next.js
x-vercel-cache: BYPASS

<!DOCTYPE html><html lang...

GET -> 200 with HTML from GET (**Cache is respected) [Expected]

HTTP/2 200
age: 7721
cache-control: public, max-age=0, must-revalidate
content-type: text/html; charset=utf-8
date: Wed, 17 Sep 2025 12:28:22 GMT
etag: "tlz1wrxmz82eiu"
server: Vercel
strict-transport-security: max-age=63072000
x-matched-path: /
x-nextjs-prerender: 1
x-nextjs-stale-time: 4294967294
x-powered-by: Next.js
x-vercel-cache: HIT
content-length: 112150

<!DOCTYPE html><html lang...

[elbajo]

Fun fact: this reproduces on vercel.com

curl -iX POST https://vercel.com -F 'payload={"message":"Testing multipart form data POST"}' | less

HTTP/2 200
accept-ch: Sec-CH-Prefers-Color-Scheme
age: 0
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-security-policy: default-src 'self' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com *.chilipiper.com https://risk.clearbit.com https://react-tweet.vercel.app/*;script-src 'self' 'unsafe-eval' 'unsafe-inline' 'inline-speculation-rules' https://cdn.heapanalytics.com *.heapanalytics.com https://www.googletagmanager.com https://www.google-analytics.com https://snap.licdn.com https://www.youtube.com *.doubleclick.net cdn.vercel-insights.com va.vercel-scripts.com *.cr-relay.com *.unifyintent.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com *.chilipiper.com https://risk.clearbit.com https://react-tweet.vercel.app/*;style-src 'self' 'unsafe-inline' vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com *.chilipiper.com https://risk.clearbit.com https://react-tweet.vercel.app/*;img-src 'self' blob: data: *.github.io avatars.githubusercontent.com user-images.githubusercontent.com vercel.com vercel.live *.vercel.sh assets.vercel.com cdn.raster.app https://images.ctfassets.net https://heapanalytics.com https://*.ads.linkedin.com https://www.google.com https://i.ytimg.com https://s3.amazonaws.com pbs.twimg.com https://www.gravatar.com https://lishhsx6kmthaacj.public.blob.vercel-storage.com;media-src 'self' blob: data: vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com *.chilipiper.com https://risk.clearbit.com https://react-tweet.vercel.app/*;connect-src 'self' data: *.chilipiper.com *.ingest.sentry.io *.ingest.us.sentry.io wss://ws-us3.pusher.com sockjs-use3.pusher.com https://api.getkoala.com https://analytics.google.com https://www.google-analytics.com *.ads.linkedin.com *.doubleclick.net react-tweet.vercel.app https://*.contentful.com vercel.com *.vercel.com assets.vercel.com *.vercel.sh vercel.live wss://*.vercel.com *.codesandbox.io localhost:* chrome-extension://* https://www.youtube-nocookie.com *.chilipiper.com https://risk.clearbit.com https://react-tweet.vercel.app/*;font-src 'self' vercel.com assets.vercel.com vercel.live fonts.gstatic.com *.vercel.sh;frame-ancestors  'self'  https://vercel.com  https://app.contentful.com  https://*.contentful.com  https://*.vercel.sh  https://*.vercel.com
content-type: text/html; charset=utf-8
critical-ch: Sec-CH-Prefers-Color-Scheme
date: Wed, 17 Sep 2025 15:36:10 GMT
feature-policy: fullscreen 'self'; camera 'none'
link: </vc-ap-vercel-marketing/_next/static/media/797e433ab948586e.p.dbea232f.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </vc-ap-vercel-marketing/_next/static/media/caa3a2e1cccd8315.p.853070df.woff2>; rel=preload; as="font"; crossorigin=""; type="font/woff2", </vc-ap-vercel-marketing/_next/static/media/vercel-logotype-light.5273e3f6.svg>; rel=preload; as="image", </vc-ap-vercel-marketing/_next/static/media/vercel-logotype-dark.9f447f76.svg>; rel=preload; as="image", </vc-ap-vercel-marketing/_next/static/chunks/c06e604a163b2a15.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/3967df1040438c16.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/81a738efa89617a7.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/30e651aef295fe2c.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/fc958cf3eb67858b.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/d50967c944a12e9e.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/ac619e102e2093c0.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/d780ea8fa2cb6943.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style", </vc-ap-vercel-marketing/_next/static/chunks/61a06b4b285d99e7.css?dpl=dpl_A9xGVR1ZxbPuGvB5igwvttTKJUAb>; rel=preload; as="style"
referrer-policy: origin-when-cross-origin
server: Vercel
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: rsc, next-router-state-tree, next-router-prefetch, next-router-segment-prefetch
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-download-options: noopen
x-frame-options: DENY
x-matched-path: /home/eyJhbGciOiJIUzI1NiJ9.AA.ejh1H92kZhsc2C1cBMPqfrm8yJOMuKUfQWSMVcHiLQ8/regular
x-nextjs-prerender: 1
x-powered-by: Next.js, Payload
x-vercel-cache: BYPASS
x-vercel-id: iad1::iad1::2pnpv-1758123368705-58b2984149a0
x-xss-protection: 0

<!DOCTYPE html><html class=...