_redirects: dynamic-rule overflow silently drops rest of file; static/dynamic classification is order-dependent and unsurfaced

[MattieTK]

Which Cloudflare product(s) does this pertain to?

Workers, Pages (static assets _redirects handling in packages/workers-shared)

What is the issue or request?

The _redirects parser silently drops the remainder of a file once the dynamic-rule budget is exceeded, and the static/dynamic classification depends on rule ordering in a way that is not surfaced to the user at build or deploy time.

In parseRedirects.ts:

• canCreateStaticRule starts true and is set to false permanently the first time a rule containing a splat (*) or placeholder (:name) is encountered.
• After that point, every subsequent rule — including exact-path rules that would otherwise be static — is counted against the 100 dynamic-rule budget.
• When dynamicRules > maxDynamicRules (100), the parser breaks and skips all remaining lines, including any catch-all at the end of the file. The invalid entry records this, but nothing surfaces it to the user during wrangler deploy.

The documented limit of "2,000 static + 100 dynamic" is therefore only achievable if the entire file is ordered static-first. A single dynamic rule placed early collapses the effective static budget, and a file with more than 100 rules after the first dynamic rule loses its tail with no visible error.

This was reported publicly here: https://x.com/samuelcolvin/status/2076993431818084700 — a large _redirects file 404'd everything after the point where the dynamic budget overflowed, including the catch-all, with no build-time signal.

Requested changes

Two options, not mutually exclusive:

1. Non-breaking: surface a warning at build/deploy time. Emit a warning from wrangler deploy (and wrangler dev) when:

   • the dynamic-rule limit is exceeded and lines are skipped, or
   • static rules appear after a dynamic rule (so they are being counted as dynamic).

   The invalid messages already contain this information; they just are not surfaced. This changes no runtime behaviour.

2. Behavioural fix, gated behind a compatibility date / redirects.version. Classify rules by their own shape (splat/placeholder → dynamic, otherwise static) regardless of position, so exact-path rules after a dynamic rule are counted and matched as static.

   This is a breaking change and should not apply to already-deployed configs:

   • Previously-dropped rules would start firing.
   • Precedence would change: staticRedirectsMatcher (exact-map) is evaluated before generateRedirectsMatcher (ordered regex) in rules-engine.ts, so reclassifying an exact-path rule that currently sits after a splat would move it ahead of that splat and can change which redirect wins for overlapping paths — even in files that never approach the limit.

   The existing redirects.version gate in generateRedirectsMatcher and/or a compatibility date would let new deployments opt into the new semantics while existing deployments keep current behaviour.

Docs

The current behaviour is being documented in cloudflare-docs (the _redirects "Per file" section) so that the ordering requirement and the silent-drop behaviour are explicit in the meantime: cloudflare/cloudflare-docs#32083

[workers-devprod]

Note

This is an automated, advisory triage report generated by workers-devprod. It is not an official maintainer response — a maintainer will follow up.

🤖 Automated triage report

Issue Triage: #14694

Summary

The _redirects parser silently drops the rest of the file once the 100 dynamic-rule budget is exceeded, and its static/dynamic classification is order-dependent — neither is surfaced to the user at build or deploy time, so a large file can 404 its tail (including a catch-all) with no signal.

Classification

• Type: Bug
• Component: packages/workers-shared (_redirects parsing; consumed by Wrangler / Pages & Workers Assets)
• Severity: High
• Has Reproduction: Yes (root cause pinpointed in parseRedirects.ts; public report linked)
• Quality: Complete

Findings

• Created: not available in provided context (metadata truncated)
• Author: MattieTK (Matt 'TK' Taylor)
• Version: not specified (defect is present on main)
• Labels: not available in provided context (metadata truncated)
• Comments: not available in provided context (metadata truncated)

Note: context.json is a single-line JSON blob whose body exceeds the reader's per-line display limit, so label/comment/date/state metadata beyond the body could not be read. This triage is based on the issue body, which is complete and self-contained.

Analysis

• Root cause is precisely identified. In parseRedirects.ts, canCreateStaticRule starts true and is permanently flipped to false the first time a rule with a splat (*) or placeholder (:name) is seen. Every subsequent rule — even exact-path rules that would be static — then counts against the 100 dynamic-rule budget.
• Silent data loss. When dynamicRules > maxDynamicRules (100), the parser breaks and skips all remaining lines, including a trailing catch-all. It records an invalid entry, but nothing surfaces to the user during wrangler deploy or wrangler dev.
• Documented limit is misleading. The "2,000 static + 100 dynamic" limit is only achievable if the file is ordered static-first; a single early dynamic rule collapses the effective static budget.
• Real-world impact confirmed. Linked public report (x.com/samuelcolvin) describes a large _redirects file 404'ing everything after the dynamic-budget overflow, including the catch-all, with no build-time error.
• Component confirmed. _redirects handling lives in packages/workers-shared and is surfaced through Wrangler; per the triage mapping this is a workers-sdk (Wrangler/Pages/Assets) issue, not a runtime/workerd issue.

Recommendation

Status: KEEP OPEN

Reasoning: This is a high-quality, actionable bug with a clear root-cause analysis, a real-world reproduction, and concrete proposed fixes. It represents genuine silent data loss (routes/catch-all dropped with no error), which is serious. It is not a duplicate, spam, stale, or user error.

Action: Triage to the Pages / Workers Assets team owning packages/workers-shared. Implement the non-breaking option first — emit a warning from wrangler deploy and wrangler dev when the dynamic-rule limit is exceeded or rules are dropped — and evaluate the order-dependent classification behavior for a follow-up (potentially breaking) fix.

Suggested Labels: (none applied — actual repo labels could not be verified from the truncated context; a maintainer should apply the appropriate product label, e.g. Workers + Assets / Pages, and a bug label)

Suggested Comment

Thanks for the detailed write-up and root-cause analysis. Confirming this is a real problem: once the dynamic-rule budget is exceeded the parser breaks and silently drops the rest of the file (including a trailing catch-all), and the static/dynamic classification being order-dependent isn't surfaced anywhere at build or deploy time.

As a first step we should implement the non-breaking option — emit a warning from wrangler deploy and wrangler dev when the dynamic-rule limit is exceeded or rules are dropped — so this failure mode is at least visible. We'll track the order-dependent classification behavior separately since changing it may be breaking. We'll pick this up on the team that owns packages/workers-shared.

Structured summary (JSON)

{
  "issueNumber": 14694,
  "title": "_redirects parser silently drops rules after the dynamic-rule budget is exceeded, with no build/deploy-time warning",
  "githubUrl": "https://github.com/cloudflare/workers-sdk/issues/14694",
  "recommendation": "KEEP OPEN",
  "difficulty": "medium",
  "reasoning": "High-quality bug report with a precise root-cause analysis in parseRedirects.ts and a confirmed real-world reproduction: the parser silently drops the tail of a _redirects file (including the catch-all) once the 100 dynamic-rule budget is exceeded, causing 404s with no build-time signal.",
  "suggestedAction": "Keep open and route to the team owning packages/workers-shared. Implement the non-breaking fix first (warn from wrangler deploy/dev when the dynamic-rule limit is exceeded or rules are dropped), and track the order-dependent classification behavior as a separate, possibly breaking, follow-up.",
  "hasSuggestedComment": true,
  "suggestedLabels": []
}

[allocsys]

Opened a draft PR with a fix for this: #14709.

Per the two options discussed in the issue, this implements Option 1 (non-breaking): it doesn't touch the static/dynamic classification logic, but surfaces a warning at wrangler deploy time when the _redirects file has invalid/overflowing rules that will be silently dropped. Previously that warning only fired for wrangler dev (Miniflare), Pages, and the Vite plugin — wrangler deploy had zero client-side validation of _redirects by design, so deploy users got no signal at all.

The change reuses the existing invalid-rule message-building logic from constructRedirects() (extracted into a shared formatInvalidRedirectsWarning() helper) and calls it from resolveAssetOptions() during deploy, for warning purposes only — it does not change what gets uploaded; the server remains the authoritative parser.

Happy to adjust the approach based on feedback, or discuss Option 2 (reclassifying rules by shape, gated behind a compat date) if that's preferred instead.