{"record":{"id":"f37b7b8a9299f42f","repo":"vercel/next.js","slug":"taint-can-only-be-used-with-the-taint-flag","errorCode":null,"errorMessage":"Taint can only be used with the taint flag.","messagePattern":"Taint can only be used with the taint flag\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"packages/next/src/server/app-render/rsc/taint.ts","lineNumber":13,"sourceCode":"/*\n\nFiles in the rsc directory are meant to be packaged as part of the RSC graph using next-app-loader.\n\n*/\n\nimport * as React from 'react'\n\ntype Reference = object\ntype TaintableUniqueValue = string | bigint | ArrayBufferView\n\nfunction notImplemented() {\n  throw new Error('Taint can only be used with the taint flag.')\n}\n\nexport const taintObjectReference: (\n  message: string | undefined,\n  object: Reference\n) => void = process.env.__NEXT_EXPERIMENTAL_REACT\n  ? // @ts-ignore\n    React.experimental_taintObjectReference\n  : notImplemented\nexport const taintUniqueValue: (\n  message: string | undefined,\n  lifetime: Reference,\n  value: TaintableUniqueValue\n) => void = process.env.__NEXT_EXPERIMENTAL_REACT\n  ? // @ts-ignore\n    React.experimental_taintUniqueValue\n  : notImplemented\n","sourceCodeStart":1,"sourceCodeEnd":31,"githubUrl":"https://github.com/vercel/next.js/blob/0ae8c72462952df163f1b1e0726641bc5b40dc93/packages/next/src/server/app-render/rsc/taint.ts#L1-L31","documentation":"Thrown by the notImplemented() stub that backs taintObjectReference() and taintUniqueValue() when the experimental React flag (__NEXT_EXPERIMENTAL_REACT) is not enabled. React's experimental_taintObjectReference / experimental_taintUniqueValue are only wired in under that flag; without it the taint APIs are inert stubs that error on use. Taint APIs help prevent leaking sensitive objects/values to the client.","triggerScenarios":"Application code imports and calls experimental_taintObjectReference or experimental_taintUniqueValue (the Next.js re-exports taintObjectReference/taintUniqueValue) while __NEXT_EXPERIMENTAL_REACT is falsy. The ternary at taint.ts:19/27 selects notImplemented, which throws on invocation.","commonSituations":"Using React's experimental taint API in a project without enabling experimental React; a tutorial/library that assumes the flag is set; building a security feature (preventing secrets from reaching client bundles) without the required experimental channel.","solutions":["Enable experimental React by setting __NEXT_EXPERIMENTAL_REACT=1 (or the project's documented experimental flag mechanism) if you truly need taint.","If taint is optional, guard its usage behind a feature check and avoid calling it when the flag is off.","Confirm your React/Next.js versions support the taint APIs before relying on them.","Remove the taint calls if you do not need the experimental protection."],"exampleFix":"// before\n// import { taintObjectReference } from 'next/dist/.../taint'\n// taintObjectReference('secret', user) // throws without flag\n\n// after: enable experimental react\n// __NEXT_EXPERIMENTAL_REACT=1 next build","handlingStrategy":"type-guard","validationCode":"// Only call taint when the experimental flag is active.\nconst TAINT_ENABLED = process.env.__NEXT_EXPERIMENTAL_REACT === '1' || !!process.env.__NEXT_EXPERIMENTAL_REACT\nif (TAINT_ENABLED) taintObjectReference('secret', obj)","typeGuard":"function isTaintAvailable(): boolean {\n  return Boolean(process.env.__NEXT_EXPERIMENTAL_REACT)\n}","tryCatchPattern":null,"preventionTips":["Enable __NEXT_EXPERIMENTAL_REACT only if you depend on the taint APIs.","Guard taint calls behind a capability check.","Confirm your React version supports experimental taint.","Avoid shipping taint calls in shared libraries that run without the flag."],"tags":["taint","security","experimental-react","configuration"],"analyzedSha":"0ae8c72462952df163f1b1e0726641bc5b40dc93","analyzedAt":"2026-08-06T19:44:29.143Z","schemaVersion":2},"datasetVersion":"2026-08-07T02:17:10.218Z"}