remix-run/remix · error · Error

invalid bypass pattern ${JSON.stringify(pattern)}: tail wild

Error message

invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last

What it means

parseBypassSegment throws when a tail wildcard '{name...}' appears anywhere except the last path segment. A rest/tail wildcard matches everything remaining, so it can only terminate the pattern. Earlier segments must be static values or single-segment wildcards.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:295

    return { type: 'static', value: segment }
  }

  let wildcardName = segment.slice(1, segment.length - 1)
  if (wildcardName === '') {
    throw new Error(
      `invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`,
    )
  }

  if (wildcardName === '$') {
    throw new Error(
      `invalid bypass pattern ${JSON.stringify(pattern)}: "{$}" is not supported in cop-middleware`,
    )
  }

  if (wildcardName.endsWith('...')) {
    if (!isLastSegment) {
      throw new Error(
        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`,
      )
    }

    if (wildcardName.length === 3) {
      throw new Error(
        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name`,
      )
    }

    return { type: 'rest' }
  }

  return { type: 'wildcard' }
}

function matchesBypassPattern(pattern: BypassPattern, context: RequestContext): boolean {
  if (pattern.method != null && pattern.method !== context.method) {

View on GitHub (pinned to 9696913134)

Solutions

Move the tail wildcard to the end: '/files/{path...}' instead of '/files/{path...}/edit'
If you need a middle catch-all, restructure into multiple bypass patterns or handle it in middleware logic

Example fix

// before
cop.addInsecureBypassPattern('/files/{rest...}/edit')
// after
cop.addInsecureBypassPattern('/files/{rest...}')

Defensive patterns

Strategy: validation

Validate before calling

function tailWildcardIsLast(pattern: string): boolean {
  const segs = pattern.slice(1).split('/')
  const tailIdx = segs.findIndex((s) => /^\{.*\.\.\.\}$/.test(s))
  return tailIdx === -1 || tailIdx === segs.length - 1
}

Prevention

Remember tail wildcards terminate matching; place them last
Express middle-catch-all needs with multiple patterns or middleware logic

When it happens

Trigger: addInsecureBypassPattern('/files/{rest...}/edit') or any pattern where a '...' wildcard is followed by another segment.

Common situations: Attempting to express 'match some middle portion then more segments'; adapting glob patterns like '/files/**/edit' into wildcard syntax incorrectly.

Related errors

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/600e4e1d3e0b428e. Report an issue: GitHub.