oxc-project/oxc · warning · OxcDiagnostic

No duplicate polyfills from Polyfill.io are allowed. {polyfi

Error message

No duplicate polyfills from Polyfill.io are allowed. {polyfill_name} already shipped with Next.js.

What it means

Warning from oxlint rule `nextjs/no-unwanted-polyfillio`. Next.js already polyfills a fixed feature list (`NEXT_POLYFILLED_FEATURES`); requesting those same features from Polyfill.io ships duplicate polyfill code to every visitor. The rule parses the `features` query of polyfill.io script URLs and reports each overlap; the same rule also warns that polyfill.io itself is a security risk after the June 2024 supply-chain takeover.

Source

Thrown at crates/oxc_linter/src/rules/nextjs/no_unwanted_polyfillio.rs:18

use cow_utils::CowUtils;
use oxc_ast::{
    AstKind,
    ast::{JSXAttributeItem, JSXAttributeName, JSXAttributeValue},
};
use oxc_diagnostics::OxcDiagnostic;
use oxc_macros::declare_oxc_lint;
use oxc_semantic::AstNode;
use oxc_span::Span;

use crate::{
    context::{ContextHost, LintContext},
    rule::Rule,
    utils::{NEXT_POLYFILLED_FEATURES, find_url_query_value, get_next_script_import_local_name},
};

fn no_unwanted_polyfillio_diagnostic(polyfill_name: &str, span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn(format!(
        "No duplicate polyfills from Polyfill.io are allowed. {polyfill_name} already shipped with Next.js."
    ))
    .with_help("See https://nextjs.org/docs/messages/no-unwanted-polyfillio")
    .with_label(span)
}

fn polyfill_io_security_warning(span: Span) -> OxcDiagnostic {
    OxcDiagnostic::warn(
        "Using polyfill.io is a security risk due to a supply chain attack in 2024."
    )
    .with_help("Replace with a safe alternative like https://cdnjs.cloudflare.com/polyfill/ or use modern browser features directly. See: https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk")
    .with_label(span)
}

#[derive(Debug, Default, Clone)]
pub struct NoUnwantedPolyfillio;

declare_oxc_lint!(

View on GitHub (pinned to e1e7af627c)

Solutions

1. Remove the duplicated feature names from the `features` query — those ship with Next.js already.
2. Better: drop polyfill.io entirely — bundle `core-js` via your Babel preset, or use a trusted mirror such as `https://cdnjs.cloudflare.com/polyfill/`.
3. If you must keep it, request only features absent from Next.js' polyfill list.

Example fix

// before
<Script src="https://cdn.polyfill.io/v3/polyfill.min.js?features=Promise,Array.prototype.find" />

// after
<Script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=Intl.Locale" />

// any polyfill.io reference deserves review (security + duplicates):
// rg -n 'polyfill\.io' -g '*.{ts,tsx,js,jsx}' .

When it happens

Trigger: A `<Script>` from `next/script` whose `src` contains `polyfill.io` with a `?features=` list naming at least one feature Next.js already polyfills (e.g. `Promise`, `Array.prototype.find`, `fetch`).

Common situations: Legacy boilerplate loading `https://cdn.polyfill.io/v3/polyfill.min.js?features=...`; keeping old-browser support via polyfill.io from before the 2024 compromise.

Related errors

• A font-display parameter is missing (adding `&display=option
• `{font_display_value}` is not a recommended font-display val
• `rel="preconnect"` is missing from Google Font.
• Do not use `<a>` elements to navigate between Next.js pages.
• Using `<img>` could result in slower LCP and higher bandwidt

AI-assisted analysis of oxc-project/oxc@e1e7af627c (2026-08-20). Data as JSON: /api/errors/e64d4b418534be55. Report an issue: GitHub.