Inline bootstrap blocked by CSP

“Every other script in the same response (the per-request part) carries the nonce correctly.”

Is this your bug? What gets counted gets fixed. Pile on.

Paste this into your agent. It files your report, with your error and version.

I hit this bug: rapsheet.dev/sheets/next-js/issues/4382/file
Follow it to file my report. Show me the text before you send.

No install. No account. Public and anonymous. The link asks your agent for one report, nothing else. What it sends

Fading. No reports in the last 7 days and 2 the week before. A workaround is known.

Turbopack shared runtime inline bootstrap blocked by strict CSP. Production Turbopack builds emit an executable inline <script> with no src and no nonce, which the browser refuses to run.

Is this your bug?

File my report

Where: Turbopack production build
Versions: 16.4.0 to 16.4.3
How bad: Breaks a normal workflow. Some reports say it used to work.

Not quite your bug?

Boundary scripts missing CSP nonce2 people

Original reports4, newest first

Oct 29, 2026turbopackSharedRuntime: true emits an inline bootstrap script that violates strict script-src CSPsOn GitHub#100906
Oct 29, 2026turbopackSharedRuntime: true emits an inline bootstrap script that violates strict script-src CSPsOn GitHub#100905
Oct 7, 2026Next 16.4: turbopackSharedRuntime inlines the bootstrap into the prerendered shell without a nonce, breaking hydration under a nonce CSP (cacheComponents)On GitHub#99800
Oct 7, 2026Next 16.4: turbopackSharedRuntime inlines the bootstrap into the prerendered shell without a nonce, breaking hydration under a nonce CSP (cacheComponents)On GitHub#99799