Redirects from proxy drop the _rsc search param, while rewrites and next.config redirects keep it

Link to the code that reproduces this issue

https://github.com/fadomire/nextjs-rsc-proxy-redirect-repro

To Reproduce

1. install deps: npm i
2. Start the application in dev mode: npm dev
3. request in RSC mode an url that has a redirect in proxy.ts: curl -sI -H 'RSC: 1' 'http://localhost:3000/redirect-source?_rsc=abc123'

Current vs. Expected behavior

Current: the 307 redirect sent by proxy.ts loose the _rsc params but still has the RSC:1 header

Expected behavior: the 307 redirect sent by proxy.ts either remove the RSC:1 header or adds a valid _rsc params to the Location

Provide environment information

Operating System:
  Platform: darwin
  Arch: arm64
  Version: Darwin Kernel Version 27.0.0: Tue Aug 11 21:05:27 PDT 2026; root:xnu-13432.1.9~1/RELEASE_ARM64_T8103
  Available memory (MB): 16384
  Available CPU cores: 8
Binaries:
  Node: 24.14.1
  npm: 11.11.0
  Yarn: 4.18.0
  pnpm: 12.4.1
Relevant Packages:
  next: 16.4.0-canary.46 // Latest available version is detected (16.4.0-canary.46).
  eslint-config-next: N/A
  react: 19.3.0
  react-dom: 19.3.0
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Middleware

Which stage(s) are affected? (Select all that apply)

next dev (local), next build (local), next start (local), Other (Deployed)

Additional context

Depending on Cache architecture (CDN, etc), it can lead to cache poisoning. Behind a shared cache keyed on the URL — the very case _rsc exists for — this client-specific 307 is served back to other users. Also when user receive the redirect from proxy.ts as it has RSC:1 header but no _rsc param, nextjs run validateRSCRequestHeaders and return his own 307 redirect

• Doing a rewrite in proxy.ts or a redirect via next.config preserve the _rsc param
• Related issues: #79346 #65783 #65787 #76925 all closed for inactivity
• Secondary defect — the validation 307 is sent before setVaryHeader() runs (base-server.ts#L2477 vs #L2492), so it carries no Vary and inherits the Cache-Control set by the application.
• Maybe we could propagate rscHash into the Location in the redirect branch, as the rewrite branch already does ?