nextjs - 💡(How to fix) Fix misdetected workspace root (from stray parent lockfile) causes RAM exhaustion (40+ GB) and infinite module-resolution retry on first request [1 comments, 2 participants]

Link to the code that reproduces this issue

I will provide a minimal reproduction shortly. The issue is 100% reproducible with the steps below on a stock create-next-app + Tailwind v4 project.

To Reproduce

Environment setup (the trigger):

1. Create an empty/orphan package-lock.json in a parent directory of your project. This can happen accidentally by running npm install in your home folder. Example content:

   {
     "name": "BobCleaner",
     "lockfileVersion": 3,
     "requires": true,
     "packages": {}
   }

   Location: C:\Users\<name>\package-lock.json (no package.json beside it)

2. Create a Next.js 16 project in a subdirectory, e.g. C:\Users\<name>\Desktop\myapp:

   npx create-next-app@latest myapp

   Use App Router + Tailwind v4 (@tailwindcss/postcss).

3. Project structure:

   C:\Users\<name>\package-lock.json   <-- orphan
   C:\Users\<name>\Desktop\myapp\
       package.json
       package-lock.json
       postcss.config.mjs
       node_modules\
       ...

Steps:

1. cd into the project folder and run npm run dev.
2. Next.js prints the expected warning about multiple lockfiles and picks C:\Users\<name>\ as the inferred workspace root.
3. Open http://localhost:3000 in a browser.
4. Observe:
   • Compiler throws Can't resolve 'tailwindcss' in 'C:\Users\<name>\Desktop' repeatedly
   • Node workers start spawning and RAM usage grows unbounded (observed: one parent Node process reaching 43,516 MB, dozens of child workers, see screenshot)
   • The machine becomes unresponsive if not killed

Mitigation that works:

• Deleting the orphan C:\Users\<name>\package-lock.json — OR —
• Setting turbopack.root: __dirname in next.config.ts

Either fix makes the dev server behave normally.

Current vs. Expected behavior

Current behavior:

When Next.js infers a workspace root from a stray parent package-lock.json, module resolution for CSS/PostCSS-related imports (e.g. @import "tailwindcss") is performed relative to the wrong root. The resolver (enhanced-resolve) walks up from C:\Users\<name>\Desktop → C:\Users\<name> → C:\Users → [C:](cci:9://file:///:0:0-0:0) looking for node_modules, never finding one, and throws:

Error: Can't resolve 'tailwindcss' in 'C:\Users\BobCleaner\Desktop'
    at finishWithoutResolve (...\enhanced-resolve\lib\Resolver.js:587:18)
    ...
  details: "resolve 'tailwindcss' in 'C:\\Users\\BobCleaner\\Desktop'\n" +
    '  Parsed request is a module\n' +
    '  No description file found in C:\\Users\\BobCleaner\\Desktop or above\n' +
    '  resolve as module\n' +
    "    C:\\Users\\BobCleaner\\Desktop\\node_modules doesn't exist or is not a directory\n" +
    "    C:\\Users\\BobCleaner\\node_modules doesn't exist or is not a directory\n" +
    "    C:\\Users\\node_modules doesn't exist or is not a directory\n" +
    "    C:\\node_modules doesn't exist or is not a directory"

Instead of failing once with a clear actionable error, the dev server:

1. Retries/respawns worker processes continuously.
2. The file watcher appears to scan the entire inferred parent tree (C:\Users\<name>\), which on a normal user profile contains tens of GB of files (Documents, Downloads, AppData, OneDrive, etc.).
3. RAM usage grows without any cap. In my case, one parent Node process reached 43.5 GB within seconds, with 20+ child workers. This can OOM-crash or freeze a machine.

Screenshot of Task Manager during the incident: (attach the Task Manager screenshot here)

Expected behavior:

1. Fail fast, fail once. If a module cannot be resolved during compilation, emit a single clear error and stop — do not respawn workers or retry in a hot loop.
2. Memory safeguard. Turbopack/Next.js workers should have an upper bound on RAM usage; a single dev session should never be able to allocate 40+ GB.
3. Respect turbopack.root. When turbopack.root is explicitly configured, all downstream resolvers (PostCSS / enhanced-resolve / file watcher scope) should honor it. In my testing, the inferred-root warning still affects CSS module resolution even when turbopack.root is set, unless the stray lockfile is physically deleted.
4. Stricter root detection. An empty/orphan package-lock.json with no sibling package.json should not be treated as a workspace root. At minimum, the warning about multiple lockfiles should be promoted to an error (or the detection should prefer the lockfile nearest to the current working directory, not the outermost one).

Provide environment information

Operating System:
  Platform: win32
  Arch: x64
  Version: Windows 11 Enterprise
  Available memory (MB): 65297
  Available CPU cores: 32
Binaries:
  Node: 24.14.1
  npm: 11.11.0
  Yarn: N/A
  pnpm: N/A
Relevant Packages:
  next: 16.2.4 // Latest available version is detected (16.2.4).
  eslint-config-next: N/A
  react: 19.2.4
  react-dom: 19.2.4
  typescript: 5.9.3
Next.js Config:
  output: N/A

Which area(s) are affected? (Select all that apply)

Turbopack, CSS

Which stage(s) are affected? (Select all that apply)

next dev (local)

Additional context

Configuration details:

• Tailwind v4 via @tailwindcss/postcss (the default setup from create-next-app)
• postcss.config.mjs:

  const config = {
    plugins: {
      "@tailwindcss/postcss": {},
    },
  };
  export default config;

• next.config.ts (after mitigation):

  const nextConfig: NextConfig = {
    turbopack: { root: __dirname },
    experimental: {
      serverActions: { bodySizeLimit: "6mb" },
    },
    // ...
  };

Why this matters for Windows users specifically:

On Windows it is extremely common to accidentally create package-lock.json in C:\Users\<name>\ by running npm install in the default PowerShell/CMD starting directory. The user has no obvious reason to suspect this file exists, and the symptom (Tailwind can't resolve + RAM explosion) is very far from the actual cause (orphan lockfile in home folder). The error message contains no hint pointing to the lockfile.

Severity:

This is not just a confusing error — it is an uncontrolled resource exhaustion that can make a developer machine unusable. On machines with less RAM than mine (I have 64 GB), this would OOM-kill the session or trigger a BSOD/hang before the user can react.

Suggested fixes (in order of impact):

1. Hard cap on Turbopack worker memory / stop respawning on unresolvable modules.
2. When turbopack.root is set explicitly in config, skip the multi-lockfile inference entirely.
3. Detect and ignore "empty" package-lock.json files (no packages / no package.json sibling) during root inference, or at least warn loudly.
4. In the multi-lockfile warning, prefer the lockfile closest to the CWD instead of the outermost one.

I have not yet tested against next@canary — will update if I find the exact canary that introduced the behavior.