Make sure to 404 for /_next/static (#8564)

packages/next-server/server/next-server.ts

@@ -208,6 +208,10 @@ export default class Server {
           // The commons folder holds commonschunk files
           // The chunks folder holds dynamic entries
           // The buildId folder holds pages and potentially other assets. As buildId changes per build it can be long-term cached.
+
+          // make sure to 404 for /_next/static itself
+          if (!params.path) return this.render404(req, res, parsedUrl)
+
           if (
             params.path[0] === CLIENT_STATIC_FILES_RUNTIME ||
             params.path[0] === 'chunks' ||

test/integration/production/test/index.test.js

@@ -80,6 +80,11 @@ describe('Production Usage', () => {
       expect(res.status).toBe(404)
     })
 
+    it('should render 404 for /_next/static route', async () => {
+      const html = await renderViaHTTP(appPort, '/_next/static')
+      expect(html).toMatch(/This page could not be found/)
+    })
+
     it('should render 200 for POST on page', async () => {
       const res = await fetch(`http://localhost:${appPort}/about`, {
         method: 'POST'

test/integration/serverless/test/index.test.js

@@ -52,6 +52,11 @@ describe('Serverless', () => {
     expect(html).toMatch(/This page could not be found/)
   })
 
+  it('should render 404 for /_next/static', async () => {
+    const html = await renderViaHTTP(appPort, '/_next/static')
+    expect(html).toMatch(/This page could not be found/)
+  })
+
   it('should render an AMP page', async () => {
     const html = await renderViaHTTP(appPort, '/some-amp?amp=1')
     expect(html).toMatch(/Hi Im an AMP page/)