HTTP 500 on malformed request body for server action (JSON parse SyntaxError)

Link to the code that reproduces this issue

https://github.com/artemzhdev/next-js-server-action-500

To Reproduce

1. Run your application and trigger any server action from the client (browser)
2. Find POST request related to the server action in the NETWORK tab and copy it as curl
3. Slightly modify it to make the request body to contain any mailformed JSON (like "["). You can just replace " --data-raw '[]'" with " --data-raw '[' -v" at the end.
4. Try to run this request using terminal

Current vs. Expected behavior

Current behavior: HTTP 500.
Expected behavior: HTTP 400 (Bad Request)

Provide environment information

NextJS version: 15.3.6 & 16.0.1.

Which area(s) are affected? (Select all that apply)

Server Actions

Which stage(s) are affected? (Select all that apply)

next start (local)

Additional context

My site is being scanned by some vulnerability scanner. It's not an issue. But I use monitoring to track all 5xx errors. Such responses are tracked as high priority bugs.
Unfortunately, this happens for bad requests produced by vulnerability scanners.
My server action code is not even called. And I cannot find a way to catch it in the middleware.

Start with the linked reproduction repository and the server-action POST request path in next start. Reproduce the malformed JSON request with the provided curl modification, then trace where parsing fails before the server action or middleware runs. Done means malformed request bodies receive HTTP 400 rather than HTTP 500.