---
title: "Server-only module reachable from client code (next/server-only-in-client)"
description: "Everything a \"use client\" module imports (transitively, at runtime) is bundled for the browser."
url: http://localhost:4173/rules/next/server-only-in-client
updated: 2026-11-11
---

# Server-only module reachable from client code

> `next/server-only-in-client` is a vetd rule. It flags: Server-only module reachable from client code. It runs on every `check`, together with the TypeScript check.

| Fact | Value |
| --- | --- |
| Rule id | `next/server-only-in-client` |
| Severity | error |
| Group | Server and client boundaries |
| Tags | security, nextjs-16, correctness |

## Why it matters

Everything a "use client" module imports (transitively, at runtime) is bundled for the browser. Modules marked `server-only`, `next/headers`, Node built-ins or configured server modules (DB clients, secrets) either break the build or leak server code.

## How to fix it

Break the chain shown in `chain`: import a type-only binding (`import type`), move the server call into a Server Component/Action, or split the module.

## Credit

Based on work by:

- [Next.js team](https://nextjs.org): Documents 'environment poisoning': server-only code imported into a Client Component leaks into the bundle, and the server-only package turns that into a build error.

## References

- [Server and Client Components (preventing environment poisoning)](https://nextjs.org/docs/app/getting-started/server-and-client-components), Next.js
- [How to think about data security in Next.js](https://nextjs.org/docs/app/guides/data-security), Next.js
- [Server Components – React](https://react.dev/reference/rsc/server-components), React

## Related rules

- [`next/client-env`](http://localhost:4173/rules/next/client-env.md)
- [`next/server-hooks`](http://localhost:4173/rules/next/server-hooks.md)

## Get this text from vetd

MCP: call `explain` with `{ "diagnosticId": "next/server-only-in-client" }`. CLI: `npx vetd explain next/server-only-in-client`.

---

[All 92 rules](http://localhost:4173/rules.md) · Previous: [`next/non-serializable-props`](http://localhost:4173/rules/next/non-serializable-props.md) · Next: [`next/server-actions`](http://localhost:4173/rules/next/server-actions.md)