vercel · lnuvy · Apr 12, 2026
diff --git a/packages/next/src/server/lib/router-server.ts b/packages/next/src/server/lib/router-server.ts
@@ -523,17 +523,24 @@ export async function initialize(opts: {
           return
         }
 
-        if (
-          !res.getHeader('cache-control') &&
-          matchedOutput.type === 'nextStaticFolder'
-        ) {
-          if (opts.dev && !isNextFont(parsedUrl.pathname)) {
-            res.setHeader('Cache-Control', 'no-cache, must-revalidate')
-          } else {
-            res.setHeader(
-              'Cache-Control',
-              'public, max-age=31536000, immutable'
-            )
+        if (matchedOutput.type === 'nextStaticFolder') {
+          if (!res.getHeader('cache-control')) {
+            if (opts.dev && !isNextFont(parsedUrl.pathname)) {
+              res.setHeader('Cache-Control', 'no-cache, must-revalidate')
+            } else {
+              res.setHeader(
+                'Cache-Control',
+                'public, max-age=31536000, immutable'
+              )
+            }
+          }
+          // Workers created from `/_next/static/*` chunks (e.g. Turbopack's
+          // `worker-entrypoint.js`) must carry a valid Cross-Origin-Resource-Policy
+          // so that documents opting into `Cross-Origin-Embedder-Policy: require-corp`
+          // can still load them. Setting `same-origin` is safe because these are
+          // first-party build artifacts.
+          if (!res.getHeader('cross-origin-resource-policy')) {
+            res.setHeader('Cross-Origin-Resource-Policy', 'same-origin')
           }
         }
         if (!(req.method === 'GET' || req.method === 'HEAD')) {

diff --git a/test/e2e/app-dir/worker-coep/app/layout.tsx b/test/e2e/app-dir/worker-coep/app/layout.tsx
@@ -0,0 +1,8 @@
+import { ReactNode } from 'react'
+export default function Root({ children }: { children: ReactNode }) {
+  return (
+    <html>
+      <body>{children}</body>
+    </html>
+  )
+}
diff --git a/test/e2e/app-dir/worker-coep/app/page.tsx b/test/e2e/app-dir/worker-coep/app/page.tsx
@@ -0,0 +1,19 @@
+'use client'
+import { useEffect, useState } from 'react'
+
+export default function Home() {
+  const [state, setState] = useState('default')
+  useEffect(() => {
+    const worker = new Worker(new URL('./worker', import.meta.url))
+    worker.addEventListener('message', (event) => {
+      setState(String(event.data))
+    })
+    return () => worker.terminate()
+  }, [])
+  return (
+    <div>
+      <p>Worker state:</p>
+      <p id="worker-state">{state}</p>
+    </div>
+  )
+}
diff --git a/test/e2e/app-dir/worker-coep/app/worker.ts b/test/e2e/app-dir/worker-coep/app/worker.ts
@@ -0,0 +1 @@
+self.postMessage('hello')
diff --git a/test/e2e/app-dir/worker-coep/next.config.js b/test/e2e/app-dir/worker-coep/next.config.js
@@ -0,0 +1,24 @@
+/**
+ * @type {import('next').NextConfig}
+ */
+const nextConfig = {
+  async headers() {
+    return [
+      {
+        source: '/(.*)',
+        headers: [
+          {
+            key: 'Cross-Origin-Embedder-Policy',
+            value: 'require-corp',
+          },
+          {
+            key: 'Cross-Origin-Opener-Policy',
+            value: 'same-origin',
+          },
+        ],
+      },
+    ]
+  },
+}
+
+module.exports = nextConfig
diff --git a/test/e2e/app-dir/worker-coep/worker-coep.test.ts b/test/e2e/app-dir/worker-coep/worker-coep.test.ts
@@ -0,0 +1,36 @@
+import { nextTestSetup } from 'e2e-utils'
+import { retry } from 'next-test-utils'
+import type { Page, Response } from 'playwright'
+
+describe('worker-coep', () => {
+  const { next } = nextTestSetup({
+    files: __dirname,
+  })
+
+  it('should load a web worker when the document has COEP: require-corp', async () => {
+    const workerResponses: Array<{ url: string; corp: string | null }> = []
+
+    const browser = await next.browser('/', {
+      beforePageLoad(page: Page) {
+        page.on('response', (response: Response) => {
+          const url = response.url()
+          if (url.includes('/_next/static/') && /worker/i.test(url)) {
+            workerResponses.push({
+              url,
+              corp: response.headers()['cross-origin-resource-policy'] ?? null,
+            })
+          }
+        })
+      },
+    })
+
+    await retry(async () => {
+      expect(await browser.elementByCss('#worker-state').text()).toBe('hello')
+    })
+
+    expect(workerResponses.length).toBeGreaterThan(0)
+    for (const { corp } of workerResponses) {
+      expect(corp).toBe('same-origin')
+    }
+  })
+})