NAW false positive on Next.js RSC requests - rsc_flight_chunk_reference

JavaScript
, ,
1

What happened: File uploads (images ~500KB) that were working until yesterday are now being blocked by NAW with the following error:

[PU02] could not complete HTTP request to instance: error from user's HttpBody stream: blocked by NAW: rsc_flight_chunk_reference

Additionally seeing:

[PU02] could not complete HTTP request to instance: error from user's HttpBody stream: error reading a body from connection: end of file before message length reached

Environment:

  • Framework: Next.js 15.5.7 (App Router with RSC)

  • File size: ~500KB images

  • Previously working: Yes, until December 7th, 2025

  • Works locally: Yes

  • Fails on Fly.io: Yes

Expected behavior: File uploads via Next.js API routes should work as they did before. The rsc_flight_chunk_reference is a legitimate internal Next.js mechanism for streaming data between server and client in React Server Components and should not be blocked by NAW.

2

We did roll out an experimental blocker for the Next.js exploit today, but it looks like it was catching more false positives than expected. This has been temporarily rolled back while we work on better matching rules. Sorry for the inconvenience.

2 Likes