remix-run/remix · error · Error

invalid bypass pattern ${JSON.stringify(pattern)}: tail wild

Error message

invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name

What it means

parseBypassSegment throws when a tail wildcard has no name, i.e. the segment is '{...}'. Tail wildcards require a name like '{rest...}' even though the name is currently not used for capture, because bare '{...}' is ambiguous with malformed syntax.

Source

Thrown at packages/cop-middleware/src/lib/cop.ts:301

      `invalid bypass pattern ${JSON.stringify(pattern)}: empty wildcards are not allowed`,
    )
  }

  if (wildcardName === '$') {
    throw new Error(
      `invalid bypass pattern ${JSON.stringify(pattern)}: "{$}" is not supported in cop-middleware`,
    )
  }

  if (wildcardName.endsWith('...')) {
    if (!isLastSegment) {
      throw new Error(
        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards must be last`,
      )
    }

    if (wildcardName.length === 3) {
      throw new Error(
        `invalid bypass pattern ${JSON.stringify(pattern)}: tail wildcards require a name`,
      )
    }

    return { type: 'rest' }
  }

  return { type: 'wildcard' }
}

function matchesBypassPattern(pattern: BypassPattern, context: RequestContext): boolean {
  if (pattern.method != null && pattern.method !== context.method) {
    return false
  }

  let pathname = context.url.pathname
  let hasTrailingSlash = pathname.length > 1 && pathname.endsWith('/')
  let normalizedPathname =

View on GitHub (pinned to 9696913134)

Solutions

1. Name the tail wildcard: '/assets/{path...}' instead of '/assets/{...}'
2. Do not use glob '*' or '**' syntax; use the {name...} form

Example fix

// before
cop.addInsecureBypassPattern('/assets/{...}')
// after
cop.addInsecureBypassPattern('/assets/{path...}')

if (pattern.includes('{...}')) throw new Error('tail wildcard needs a name, e.g. {path...}')

const hasNoAnonymousTail = (p: string) => !p.includes('{...}')

When it happens

Trigger: addInsecureBypassPattern('/assets/{...}') — a segment whose wildcard name is exactly the '...' suffix with nothing before it (wildcardName.length === 3).

Common situations: Using glob-style '/assets/**' thinking '*' or bare '...' is supported; shorthand habits from path-to-regexp or glob libraries.

Related errors

• invalid bypass pattern ${JSON.stringify(pattern)}: empty wil
• invalid bypass pattern ${JSON.stringify(pattern)}: tail wild
• invalid bypass pattern ${JSON.stringify(pattern)}: path must
• invalid bypass pattern ${JSON.stringify(pattern)}: query str
• invalid bypass pattern ${JSON.stringify(pattern)}: empty pat

AI-assisted analysis of remix-run/remix@9696913134 (2026-08-27). Data as JSON: /api/errors/b7f794bfa1511f79. Report an issue: GitHub.