Repository navigation
Unsubstituted __WEBPACK_MODULE_REFERENCE__ placeholder emitted into production output (regression in 5.110.0) #21903
Description
Have you used AI?
Yes
Which part of webpack is affected?
optimization (tree-shaking, splitChunks, concatenation)
Bug Description
webpack emits one of its own internal placeholders,
`__WEBPACK_MODULE_REFERENCE__…__`, unsubstituted into the production bundle.
The result is a valid JavaScript identifier that was never declared, so the build
succeeds with no error or warning and it fails only at runtime:
ReferenceError: webpack_require____WEBPACK_MODULE_REFERENCE__0_ns_moduleExportsAccess_asiSafe1 is not defined
It needs three things together: a `require.ensure` boundary, a `require()` of an
ESM module whose whole module object is captured in a variable, and
`optimization.concatenateModules`. Scope hoisting is on by default in
`mode: "production"` and off in development, so this is invisible until you ship.
Works on 5.109.2, breaks from 5.110.0 through 5.110.2.
Link to Minimal Reproduction and steps to reproduce
```bash
npm install
npx webpack # succeeds
node dist/main.js # ReferenceErrordist/main.js is left unminified, so the leaked token is visible in the output.
Install [email protected] instead, with the same source and config, and it works.
The whole reproduction is this:
// src/route.js
export function load() {
return new Promise(resolve => {
require.ensure([], require => {
const whole = require("./mod.js"); // whole module object captured
resolve([whole.NAME, whole.default]);
}, "chunk");
});
}
// src/mod.js
export const NAME = "worksheet";
export default { isReducer: true };
### Expected Behavior
```markdown
One of two things:
- The placeholder is substituted correctly and the bundle runs, as it does on
5.109.2; or
- webpack fails the build with a real error.
`__WEBPACK_MODULE_REFERENCE__…__` is an internal token that should never survive
code generation. Emitting it as a bare, never-declared identifier is an invariant
violation: it turns a compiler bug into a silent runtime failure in production.Actual Behavior
The build succeeds, with no error and no warning:
```
webpack compiled successfully
```
But the emitted `dist/main.js` contains an identifier that was never declared:
```js
const whole = __webpack_require____WEBPACK_MODULE_REFERENCE__0_ns_moduleExportsAccess_asiSafe1__._;
```
It is syntactically valid, so the file parses and the build passes. Running it:
```
ReferenceError: __webpack_require____WEBPACK_MODULE_REFERENCE__0_ns_moduleExportsAccess_asiSafe1__ is not defined
```
Because the failure is at execution rather than at build time, nothing catches it
before release. It surfaces only when the affected route is first loaded.Environment
System:
OS: Windows 11 10.0.26200
CPU: (16) x64 Intel(R) Core(TM) i5-14400
Memory: 5.23 GB / 15.77 GB
Binaries:
Node: 22.22.0 - C:\nvm4w\nodejs\node.EXE
npm: 10.9.4 - C:\nvm4w\nodejs\npm.CMD
Browsers:
Chrome: 152.0.7977.65
Edge: Chromium (152.0.4191.53)
Firefox: 154.0.1
Packages:
webpack: 5.110.2
webpack-cli: 5.1.4Is this a regression?
Yes (please specify version below)
Last Working Version
v5.109.2
Additional Context
No response
Activity