fix(pages): apply the data-miss cache policy after merging staged hea…

…ders
james-elicx · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026 · Oct 12, 2026
commit cc2e7e515a612940c57c3049d00457a5a34cff95
diff --git a/packages/vinext/src/server/pages-request-pipeline.ts b/packages/vinext/src/server/pages-request-pipeline.ts
@@ -995,13 +995,17 @@ export async function runPagesRequest(
       const headers = new Headers(response.headers);
       headers.set("content-type", "application/json");
       headers.set("x-nextjs-matched-path", matchResolvedPathname(pathname));
-      // Response headers win over the staged config headers in mergeHeaders,
-      // so a next.config Cache-Control rule can't replace this policy.
-      applyCdnResponseHeaders(headers, { cacheControl: NEVER_CACHE_CONTROL });
-      const notFoundResponse = new Response("{}", { status: 404, headers });
+      const notFoundResponse = mergeHeaders(
+        new Response("{}", { status: 404, headers }),
+        matchedPathHeaders,
+        undefined,
+      );
+      // Applied after the merge, so staged config or middleware headers can't
+      // restore a cacheable policy (including adapter-owned edge headers).
+      applyCdnResponseHeaders(notFoundResponse.headers, { cacheControl: NEVER_CACHE_CONTROL });
       return {
         type: "response",
-        response: mergeHeaders(notFoundResponse, matchedPathHeaders, undefined),
+        response: notFoundResponse,
         defaultContentType: "application/json",
       };
     }

diff --git a/tests/pages-request-pipeline.test.ts b/tests/pages-request-pipeline.test.ts
@@ -9,6 +9,11 @@ import {
 import { MIDDLEWARE_SKIP_HEADER } from "../packages/vinext/src/server/headers.js";
 import { PRERENDER_REVALIDATE_HEADER } from "../packages/vinext/src/utils/protocol-headers.js";
 import { runWithExecutionContext } from "../packages/vinext/src/shims/request-context.js";
+import {
+  DefaultCdnCacheAdapter,
+  setCdnCacheAdapter,
+} from "../packages/vinext/src/shims/cdn-cache.js";
+import { CloudflareCdnCacheAdapter } from "../packages/cloudflare/src/cache/cdn-adapter.runtime.js";
 import {
   CACHEABILITY_REQUEST_STATE,
   type RouteCacheabilityState,
@@ -587,6 +592,43 @@ describe("middleware", () => {
     expect(await result.response.text()).toBe("{}");
   });
 
+  it("keeps staged edge cache headers off middleware data misses", async () => {
+    setCdnCacheAdapter(new CloudflareCdnCacheAdapter());
+    try {
+      const result = await runPagesRequest(
+        makeRequest("/unknown"),
+        baseDeps({
+          configHeaders: [
+            {
+              source: "/:path*",
+              headers: [{ key: "Cloudflare-CDN-Cache-Control", value: "max-age=3600" }],
+            },
+          ],
+          isDataReq: true,
+          isDataRequest: true,
+          hasMiddleware: true,
+          runMiddleware: makeMiddleware({
+            continue: true,
+            responseHeaders: new Headers({ "CDN-Cache-Control": "max-age=3600" }),
+          }),
+          matchPageRoute: vi.fn().mockReturnValue(null),
+          renderPage: makeRenderPage(404, "not found"),
+        }),
+      );
+
+      expect(result.type).toBe("response");
+      if (result.type !== "response") return;
+      expect(result.response.status).toBe(404);
+      expect(result.response.headers.get("cache-control")).toBe(
+        "private, no-cache, no-store, max-age=0, must-revalidate",
+      );
+      expect(result.response.headers.get("cloudflare-cdn-cache-control")).toBeNull();
+      expect(result.response.headers.get("cdn-cache-control")).toBeNull();
+    } finally {
+      setCdnCacheAdapter(new DefaultCdnCacheAdapter());
+    }
+  });
+
   it("keeps data misses as JSON 404 when generated wiring provides a no-op middleware", async () => {
     const result = await runPagesRequest(
       makeRequest("/unknown"),