AI & Agent Dev Bug Sandbox logo
AI & Agent Dev Bug Sandbox
Back to Radar

Sass BOM In Concatenated CSS Silently Breaks Selectors With PostCSS 8.5.24+ Under Webpack

When using Next.js webpack with PostCSS 8.5.24+ and Sass, a BOM emitted by Sass at the start of each module is preserved in the middle of the concatenated CSS asset. This leading U+FEFF becomes part of the first selector of affected modules, causing those CSS rules to silently fail to match elements. The build succeeds without warnings.

highConfidence 85%Next.jsAffected Vnext@16.4.0-Canary.53Affected Vpostcss@>=8.5.24

Origin Analysis

Sass emits a BOM when compressed output contains non-ASCII text. PostCSS 8.5.24+ preserves that BOM in the AST. Next.js's webpack PostCSS loader passes the PostCSS AST to css-loader, which retains each module's BOM. When Webpack extracts and concatenates CSS, BOMs from the second and subsequent modules end up in the middle of the file, where they are interpreted as part of the first selector, leading to silent rule mismatches.
1. Clone https://github.com/uaoa/next-webpack-bom-repro. 2. Run `npm install && npm run build && npm run scan`. 3. Run `npm run start` and visit http://localhost:4302/. 4. Observe that green and blue colors are missing and `scan` reports BOM offsets [0,65,132] with selectors prefixed by U+FEFF.

Fixing Code Block

Edge Case Audit

Stripping U+FEFF from CSS nodes is generally safe because BOM is not meaningful inside a stylesheet. However, if any legitimate content intentionally begins with U+FEFF (extremely rare), it will be removed. This is a workaround, not the upstream fix; the ideal fix is to normalize the CSS string and AST at the module boundary in Next.js's loader. Rollback: remove this plugin and pin postcss to 8.5.23 to avoid the issue. Performance impact of walking the AST is minimal but should be considered for very large stylesheets.

Ecosystem Topology