# @next/next/no-unwanted-polyfillio

> Disallow scripts from polyfill.io, and polyfills that Next.js already ships

The `polyfill.io` domain changed hands, and in 2024 it started serving malicious code to the sites that loaded it. A script from `https://polyfill.io/v3/` or `https://cdn.polyfill.io/v2/` is always reported.

The same service lives on at `polyfill-fastly.net`, `polyfill-fastly.io` and `cdnjs.cloudflare.com/polyfill/`. For those hosts, the rule reads the `features` parameter and reports the features Next.js already includes, such as `fetch`, `Promise`, `Map`, `URL`, `Object.entries` and `es2015` to `es2019`. Your users would download them twice.

The rule checks `<script>` elements and the component you import from `next/script`.

{/* Generated by src/codegen/lint-rule-docs.ts. Do not edit this section. */}

## Configure

Off by default. To turn it on:

```toml bunfig.toml
[lint.rules]
"@next/next/no-unwanted-polyfillio" = "error" # or "warn"
```

{/* End of the generated section. */}

## Examples

Reported:

{/* bad */}
```jsx
export default function Polyfills() {
  return <script src="https://polyfill.io/v3/polyfill.min.js?features=IntersectionObserver" />;
}
```

{/* bad */}
```jsx
import Script from "next/script";

export default function Polyfills() {
  return <Script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=fetch,Array.prototype.at" />;
}
```

Not reported, because Next.js doesn't include `IntersectionObserver`:

{/* good */}
```jsx
import Script from "next/script";

export default function Polyfills() {
  return <Script src="https://cdnjs.cloudflare.com/polyfill/v3/polyfill.min.js?features=IntersectionObserver" />;
}
```