What does _buildManifest.js in Next.js do?

Jul 23, 2025

1. What is a Next.js Build Manifest

The build manifest is an autogenerated file that has a mapping of urls to the static JS chunk generated by webpack. This is primarily used for client-side navigation by the next/link component which, among other features, eagerly loads the JS on hover based on the href attribute.

If a page is built with Next.js, we can search for the script .../_buildManifest.js within the DOM.

This file will contains:

  • A list of all routes in your application (e.g., /, /about, /blog/[slug]).
  • References to the JavaScript and CSS chunks required for each route.
  • Custom rewrite or redirect rules.

This is important for features like code splitting or dynamic routing.

Example:

self.__BUILD_MANIFEST = (function(s, a, e) {
  return {
    __rewrites: {
      afterFiles: [],
      beforeFiles: [],
      fallback: []
    },
    "/": [
      s,
      "static/chunks/317-0448f71af842a9a8.js",
      a,
      "static/css/0f3465acc91c997e.css",
      "static/chunks/pages/index-7f3f4dcd336ce91a.js"
    ],
    "/404": [
      "static/chunks/pages/404-dfe6ad64cc1521a5.js"
    ],
    "/_error": [
      "static/chunks/pages/_error-a26cab2839657c8f.js"
    ],
    "/career": [
      s,
      e,
      "static/chunks/938-6b8f4fcc98a37d13.js",
      a,
      "static/chunks/pages/career-c9ef7557325796c7.js"
    ],
    "/career/[jobId]": [
      s,
      e,
      a,
      "static/chunks/pages/career/[jobId]-0f1ed8fb671ecde0.js"
    ],
    "/products": [
      s,
      a,
      "static/chunks/pages/products-0e87273939e8e19a.js"
    ],
    "/teams": [
      s,
      a,
      "static/chunks/pages/teams-e663075e4e52231b.js"
    ],
    "/visit-us": [
      s,
      a,
      "static/chunks/pages/visit-us-5c395e014a7ac7ca.js"
    ],
    sortedPages: [
      "/",
      "/404",
      "/_app",
      "/_error",
      "/career",
      "/career/[jobId]",
      "/products",
      "/teams",
      "/visit-us"
    ]
  };
})(
  "static/chunks/571-82e69223fbb529d3.js",
  "static/chunks/101-e4df0de361f910e7.js",
  "static/chunks/131-123f1079ead20f58.js"
);

self.__BUILD_MANIFEST_CB && self.__BUILD_MANIFEST_CB();

2. An use case with _buildManifest.js

We can utilize this file to ask the user to refresh the browser when there’s new deployment. Since this file is generated during the next build process.

More detail here.

3. Be careful

This file can sometimes lead to information exposure such as:

  • Expose hidden routes: /admin, /user/[id],…
  • Analyze assets: attacker can find the vulnerabilities or exposed secrets.
  • Fingerprint frameworks & versions: like the outdated libraries/frameworks version.

Then, we need to make sure we don’t hardcode any API key on the client and protect those sensitive routes with proper authorization.

  • _ssgManifest.js: Indicates which routes are static (SSG).
  • _middlewareManifest.js: Contains route info for middleware (if used).
  • These manifests are generated automatically during next build.

Refs:

https://stackoverflow.com/questions/63510179/what-does-buildmanifest-js-in-nextjs-do-and-can-it-be-disabled