Security error with the new 0.161.0 security for PostCSS

divinerites · May 21, 2026, 2:39pm

Upgrading with 0.161.1 i get an error obviously related to new security in 0.161.0.
But despite reading and trying to understand the advice in the release doc, I just fail to understand what i have to do (in security.node permission I guess)

Any hint or advice welcome.

PS : hugo server doesn’t show this error, confirming relation with postcss process

panic: POSTCSS: failed to transform "/css/style.css" (text/css): Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions.
            at Object.existsSync (node:fs:286:18)
            at isFile (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/node.js:38:19)
            at /Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/node.js:317:11
            at eachParent (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/node.js:49:18)
            at Object.findConfig (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/node.js:305:20)
            at browserslist.loadConfig (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/node.js:223:37)
            at browserslist (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/browserslist/index.js:411:31)
            at Browsers.parse (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/autoprefixer/lib/browsers.js:54:12)
            at new Browsers (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/autoprefixer/lib/browsers.js:42:26)
            at loadPrefixes (/Users/didiergeorgieff/Documents/Git/osteo-timer/node_modules/autoprefixer/lib/autoprefixer.js:113:20) {
          code: 'ERR_ACCESS_DENIED',
          permission: 'FileSystemRead',
          resource: '/Users/didiergeorgieff/Documents/Git/package.json'
        }

jmooring · May 21, 2026, 2:50pm

Do you have a “security” section in your project configuration?
Or in your environment variables?

Check by running:

hugo config | grep security -A5

divinerites · May 21, 2026, 3:11pm

No. I had no security section.

I am trying to add one but i still get new errors (all security related)

````.browserslistrc
0.5%
last 2 versions
not dead

````

################################ SECURITY > v0.161.0 ########################

[security]

enableInlineShortcodes = true

[security.exec]

allow = [

“^(dart-)?sass(-embedded)?$”,

“^go$”,

“^git$”,

“^npx$”,

“^node$”,

“^postcss$”,

“^tailwindcss$”

]

osEnv = [

“(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$”

]

[security.funcs]

getenv = [“^HUGO_”, “^CI$”]

[security.http]

methods = [“(?i)GET|POST”]

urls = [“.*”]

divinerites · May 21, 2026, 3:17pm

And I finally just got it working with this command (and the 2 modified files upper):

NODE_OPTIONS="--permission --allow-fs-read=/Users/didiergeorgieff/Documents/Git/osteo-timer --allow-fs-read=/Users/didiergeorgieff/Documents/Git" hugo server

But I am wondering if it is a dirty hack of will be our future ?
ANd also i hve to figure how to industrilize it for Netlify.

jmooring · May 21, 2026, 3:23pm

I don’t understand the formatting of your repsonse. For example, when I run hugo config | grep security -A5 I get this:

[security]
  [security.exec]
    allow = ['^(dart-)?sass(-embedded)?$', '^go$', '^git$', '^node$', '^postcss$', '^tailwindcss$']
    osenv = ['(?i)^((HTTPS?|NO)_PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+|(XDG_CONFIG_)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$']

  [security.funcs]
    getenv = ['^HUGO_', '^CI$']

  [security.http]
    methods = ['(?i)GET|POST']
    urls = ['(?i)^https?://[a-z]', '! (?i)localhost', '! @']

  [security.node]
    [security.node.permissions]
      allowaddons = ['tailwindcss']
      allowread = ['.']
      allowworker = ['tailwindcss']

I’m running v0.161.1.

divinerites · May 21, 2026, 3:27pm

Sorry for the misunderstanding from my side.

% hugo config | grep security -A5
[security]
enableinlineshortcodes = true

[security.exec]
allow = [‘^(dart-)?sass(-embedded)?$’, ‘^go$’, ‘^git$’, ‘^npx$’, ‘^node$’, ‘^postcss$’, ‘^tailwindcss$’]
osenv = [‘(?i)^((HTTPS?|NO)PROXY|PATH(EXT)?|APPDATA|TE?MP|TERM|GO\w+|(XDG_CONFIG)?HOME|USERPROFILE|SSH_AUTH_SOCK|DISPLAY|LANG|SYSTEMDRIVE|PROGRAMDATA)$’]

[security.funcs]
getenv = [‘^HUGO_’, ‘^CI$’]

[security.http]
methods = [‘(?i)GET|POST’]
urls = [‘.*’]

[security.node]
[security.node.permissions]
allowaddons = [‘tailwindcss’]
allowchildprocess = [‘tailwindcss’]
allowread = [‘.’]
allowworker = [‘tailwindcss’]

jmooring · May 21, 2026, 3:33pm

Are you running v0.161.0 or v0.161.1?

divinerites · May 21, 2026, 3:39pm

0.161.1

jmooring · May 21, 2026, 3:43pm

I don’t have an answer for you at the moment, but the quickest solution is to disable the Node.js permission model.

[security.node.permissions]
disable = true

I have a site that passes the CSS resource through PostCSS with this postcss.config.mjs config file:

import autoprefixer from 'autoprefixer';
import { purgeCSSPlugin } from '@fullhuman/postcss-purgecss';
const purgecss = purgeCSSPlugin({
  content: ['./hugo_stats.json'],
  defaultExtractor: content => {
    const els = JSON.parse(content).htmlElements;
    return [
      ...(els.tags || []),
      ...(els.classes || []),
      ...(els.ids || []),
    ];
  },
  // https://purgecss.com/safelisting.html
  safelist: {
    deep: [/.*tippy.*/, /^sup/]
  }
});

export default {
  plugins: [
    autoprefixer,
    process.env.HUGO_ENVIRONMENT !== 'development' ? purgecss : null
  ]
};

No problems, running on Ubuntu 24.04.

divinerites · May 21, 2026, 3:53pm

Yes. Thanks. This is the cleanest quick one.
I will try to make my head around this and post something if relevant. The doc is fine but not so easy to understand at first.

Anyway million thanks (again) for your incredible reactivity (and accuracy).

jmooring · May 21, 2026, 3:54pm

Can you post your PostCSS config file? Privately if you wish.

bep · May 21, 2026, 3:57pm

My best guess is that this is browserlist (used in autoprefixer); which walks up the tree (and outside of the Hugo project) to find the first browser config. I had a similar issue in a project I tested with, and if I remember correctly they have fixed this in a recent version of browserlist so it works better with Node’s permission model. Also, there should be a way to add a browserlist config to the project itself to avoid this.

divinerites · May 21, 2026, 4:28pm

I already had added a .browserslistrc
0.5%
last 2 versions
not dead

and done
npx update-browserslist-db@latest

Mmmmm. As you ask for PostCSS this site is a old one i wanted to update.
And strangely I use “{{- $css = $css | css.PostCSS $options}}” and have no PostCSS file.

And I have import “github.com/bep/hugo-starter-tailwind-basic/v2”, and use a “tailwind.config.js” file.

I just do not remember the rationale around this. may be the cause is in this half baked postcss/tailwind and my fault.

Will try to understand my choice digging in commits.

jmooring · June 14, 2026, 5:04am

I ran into this on a site hosted by Netlify:

ERROR error building site: render: [en v1.0.0 guest] failed to render pages: render of “/opt/build/cache/hugo_cache/modules/filecache/modules/pkg/mod/github.com/jmooring/hugo-module-feature-test@v0.6.0/content/other-tests/postcss.md” failed: “/opt/build/cache/hugo_cache/modules/filecache/modules/pkg/mod/github.com/jmooring/hugo-module-feature-test@v0.6.0/layouts/other-tests/postcss/page.html:15:15”: execute of template failed: template: other-tests/postcss/page.html:15:15: executing “main” at <.Content>: error calling Content: POSTCSS: failed to transform “/temp/css” (application/octet-stream): Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions.

Repository: https://github.com/jmooring/hosting-netlify

There are no errors when I build locally, nor are there errors when using a CI/CD workflow with:

Amplify
Cloudflare Pages
Cloudflare Worker
Firebase
GitHub Pages
GitLab Pages
Render
Vercel

bep · June 14, 2026, 10:51am

I could get that working on Netlify by shifting to ESM style imports in the postcss config:

There’s a longer story here, and possibly something to be improved on in Hugo, but it’s not entirely clear to me at the moment:

Your site also works if you run hugo mod vendor and commit the source, which suggests there some Node magic walking upwards.
Your site also works if you set HUGO_CACHEDIR to e.g. */opt/build/repo/.hugo_cache"
The error points at /opt/build/cache/node_modules/autoprefixer/package.json and Hugo’s default cache dir on Netlify is /opt/build/cache/hugo_cache/ – which indicates that the overlap makes Node try to resolve inside the node_modules cache.

bep · June 15, 2026, 10:55am

I have tested the PR below OK on your projected in a similar setup as Netlify. I would say that Netlify (and I also think Cloudflare) way of placing a node_modules folder at the root of the cache dir is very shaky/buggy, but I’m guessing that ship has sailed.

github.com/gohugoio/hugo

ERR_ACCESS_DENIED issue on e.g. Netlify with Node's CJS resolver (at least)

opened 09:42AM - 15 Jun 26 UTC

bep

Bug

Ref. @jmooring 's post here: https://discourse.gohugo.io/t/security-error-with-t…he-new-0-161-0-security-for-postcss/57186/16 This issue triggered in this case because of how Netlify stores its `node_modules` cache in the same tree as the Hugo file cache. This is a hard-to-debug issue for the end user and I think we need to fix this. As I understand it, I think this is only a problem with Node's CJS resolver. E.g. when using CJS style `require` in `postcss.config.js` ``` const autoprefixer = require('autoprefixer'); module.exports = { plugins: [ autoprefixer ] } ``` And having a "pseudo" (very simplified) Hugo project stetup like this: ``` cache/node_modules/postcss cache/hugo_cache/mymodule hugo_project/node_modules/postcss ``` Hugo is built from `hugo_project`, but Node (the CJS resolver at least) seems to walk upwards from `mymodule` then get `ERR_ACCESS_DENIED` for `node_modules/postcss` and stops searching (see errror below). I'm not sure what the fix to this would look like, but I'm leaning against just dropping these `ERR_ACCESS_DENIED` errors and eventually fail with a error (with the `ERR_ACCESS_DENIED` info included if at all possible). ```bash node:internal/modules/package_json_reader:125 const parsed = modulesBinding.readPackageJSON( ^ Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions. at Object.read (node:internal/modules/package_json_reader:125:33) at packageResolve (node:internal/modules/esm/resolve:770:43) at moduleResolve (node:internal/modules/esm/resolve:859:18) at defaultResolve (node:internal/modules/esm/resolve:991:11) at #cachedDefaultResolve (node:internal/modules/esm/loader:719:20) at #resolveAndMaybeBlockOnLoaderThread (node:internal/modules/esm/loader:736:38) at nextStep (node:internal/modules/customization_hooks:189:26) at resolve (data:text/javascript;base64,Ly8gTm9kZS5qcyBFU00gcmVzb2x2ZXIgaG9vayBpbnN0YWxsZWQgYnkgSHVnby4KLy8KLy8gTm9kZSdzIEVTTSByZXNvbHZlciBkb2VzIG5vdCBjb25zdWx0IE5PREVfUEFUSCwgdW5saWtlIENKUyByZXF1aXJlKCkuCi8vIFRoYXQgYnJlYWtzIHBvc3Rjc3MuY29uZmlnLmpzIC8gYmFiZWwuY29uZmlnLmpzIC8gZXRjLiBmaWxlcyB3cml0dGVuIGluCi8vIEVTTSBhbmQgbG9hZGVkIGZyb20gb3V0c2lkZSB0aGUgcHJvamVjdCB0cmVlICh0eXBpY2FsbHkgdGhlIEh1Z28gbW9kdWxlCi8vIGNhY2hlKTogYmFyZSBpbXBvcnRzIGxpa2UgYGltcG9ydCB4IGZyb20gInBvc3Rjc3MtaW1wb3J0ImAgY2Fubm90IGJlCi8vIHJlc29sdmVkIGJ5IHdhbGtpbmcgdXAgZnJvbSB0aGUgZmlsZSdzIGxvY2F0aW9uLgovLwovLyBUaGlzIGhvb2sgbWFrZXMgdGhlIEVTTSByZXNvbHZlciBmYWxsIGJhY2sgdG8gTk9ERV9QQVRIIGZvciBiYXJlCi8vIHNwZWNpZmllcnMgd2hlbiBOb2RlJ3Mgbm9ybWFsIHJlc29sdXRpb24gZmFpbHMuIEl0IGlzIGEgbm8tb3AgZm9yCi8vIHJlbGF0aXZlL2Fic29sdXRlIHBhdGhzIGFuZCBVUkwtc2NoZW1lIHNwZWNpZmllcnMsIGFuZCBpdCBuZXZlciBmaXJlcwovLyB1bmxlc3MgTm9kZSB3b3VsZCBpdHNlbGYgaGF2ZSB0aHJvd24gRVJSX01PRFVMRV9OT1RfRk9VTkQuCi8vCi8vIFVzZXMgdGhlIHN5bmNocm9ub3VzIHJlZ2lzdGVySG9va3MgQVBJIHNvIGl0IHJ1bnMgb24gdGhlIG1haW4gdGhyZWFkIGFuZAovLyBkb2VzIG5vdCByZXF1aXJlIC0tYWxsb3ctd29ya2VyIHVuZGVyIHRoZSBOb2RlIHBlcm1pc3Npb24gbW9kZWwuCgppbXBvcnQgeyByZWdpc3Rlckhvb2tzLCBjcmVhdGVSZXF1aXJlIH0gZnJvbSAnbm9kZTptb2R1bGUnOwppbXBvcnQgeyBwYXRoVG9GaWxlVVJMIH0gZnJvbSAnbm9kZTp1cmwnOwoKY29uc3QgcmVzb2x2ZXJzID0gW107CmNvbnN0IG5wID0gcHJvY2Vzcy5lbnYuTk9ERV9QQVRIOwppZiAobnApIHsKCWNvbnN0IHNlcCA9IHByb2Nlc3MucGxhdGZvcm0gPT09ICd3aW4zMicgPyAnOycgOiAnOic7Cglmb3IgKGNvbnN0IHAgb2YgbnAuc3BsaXQoc2VwKSkgewoJCWlmIChwKSByZXNvbHZlcnMucHVzaChjcmVhdGVSZXF1aXJlKHAgKyAnL18nKSk7Cgl9Cn0KCmZ1bmN0aW9uIGlzQmFyZVNwZWNpZmllcihzKSB7CglpZiAoIXMpIHJldHVybiBmYWxzZTsKCWlmIChzLnN0YXJ0c1dpdGgoJy4nKSB8fCBzLnN0YXJ0c1dpdGgoJy8nKSB8fCBzLnN0YXJ0c1dpdGgoJyMnKSkgcmV0dXJuIGZhbHNlOwoJaWYgKC9eW2Etel1bYS16MC05Ky4tXSo6L2kudGVzdChzKSkgcmV0dXJuIGZhbHNlOwoJcmV0dXJuIHRydWU7Cn0KCnJlZ2lzdGVySG9va3MoewoJcmVzb2x2ZShzcGVjaWZpZXIsIGNvbnRleHQsIG5leHRSZXNvbHZlKSB7CgkJdHJ5IHsKCQkJcmV0dXJuIG5leHRSZXNvbHZlKHNwZWNpZmllciwgY29udGV4dCk7CgkJfSBjYXRjaCAoZXJyKSB7CgkJCWlmIChlcnI/LmNvZGUgIT09ICdFUlJfTU9EVUxFX05PVF9GT1VORCcpIHRocm93IGVycjsKCQkJaWYgKCFpc0JhcmVTcGVjaWZpZXIoc3BlY2lmaWVyKSkgdGhyb3cgZXJyOwoJCQlmb3IgKGNvbnN0IHIgb2YgcmVzb2x2ZXJzKSB7CgkJCQl0cnkgewoJCQkJCWNvbnN0IHJlc29sdmVkID0gci5yZXNvbHZlKHNwZWNpZmllcik7CgkJCQkJcmV0dXJuIHsgdXJsOiBwYXRoVG9GaWxlVVJMKHJlc29sdmVkKS5ocmVmLCBzaG9ydENpcmN1aXQ6IHRydWUsIGZvcm1hdDogbnVsbCB9OwoJCQkJfSBjYXRjaCAoXykgeyAvKiB0cnkgbmV4dCAqLyB9CgkJCX0KCQkJdGhyb3cgZXJyOwoJCX0KCX0sCn0pOwo=:39:11) at nextStep (node:internal/modules/customization_hooks:189:26) at resolveWithHooks (node:internal/modules/customization_hooks:417:10) { code: 'ERR_ACCESS_DENIED', permission: 'FileSystemRead', resource: '/Users/bep/dev/dump/testinroot/node_modules/postcss/package.json' } Node.js v24.14.1 ```

jmooring · June 18, 2026, 7:53pm

In our documentation, the configuration files used with css.PostCSS, js.Babel, and resources.PostProcess are now shown as .mjs files using ESM syntax.

This works fine on Netlify as noted above, and with v0.163.3 and later the .mjs files can also be used in modules.

baltpeter · June 29, 2026, 9:52pm

If you use the postcss-preset-env plugin, there is an additional error, even after converting the config to ESM:

ERROR error building site: render: [de v1.0.0 guest] failed to render pages: render of "/my/path/content/de/blog/myblog/index.md" failed: "/my/path/layouts/_default/baseof.html:35:42": execute of template failed: template: single.html:35:42: executing "single.html" at <$style.RelPermalink>: error calling RelPermalink: POSTCSS: failed to transform "/styles/index.css" (text/css): 
Error: Access to this API has been restricted. Use --allow-fs-read to manage permissions.
    at Object.existsSync (node:fs:289:18)
    at isFile (/my/path/node_modules/browserslist/node.js:42:19)
    at /my/path/node_modules/browserslist/node.js:200:16
    at eachParent (/my/path/node_modules/browserslist/node.js:53:18)
    at Object.getStat (/my/path/node_modules/browserslist/node.js:198:15)
    at Object.browserslist [as default] (/my/path/node_modules/browserslist/index.js:439:19)
    at plugin (/my/path/node_modules/postcss-preset-env/dist/index.js:437:61)
    at file:///my/path/postcss.config.mjs?t=1782769228990:12:9
    at ModuleJob.run (node:internal/modules/esm/module_job:413:25)
    at async onImport.tracePromise.__proto__ (node:internal/modules/esm/loader:660:26) {
  code: 'ERR_ACCESS_DENIED',
  permission: 'FileSystemRead',
  resource: '/my/browserslist-stats.json'
}

The problem is that Browserslist walks up the directory tree until it finds a browserlists-stats.json: browserslist/node.js at 03ba4e2724b4f77c408498d937c352c2e38f9e72 · browserslist/browserslist · GitHub

If there isn’t one in the project directory, Hugo blocks the reads by default.

I was able to solve this by explicitly allowing the reads in my config:

[security]
  [security.node]
    [security.node.permissions]
      allowRead = ['.', '/**/browserslist-stats.json']

Alternatively, you could also just create a browserslist-stats.json containing an empty object ({}).

Topic		Replies	Views
Hugo 115.1 and PostCSS do not work well enough to be usable support modules , off-topic	8	1591	July 19, 2023
Having trouble with PostCSS trying to use PurgeCSS support	13	2716	October 8, 2022
SCSS compilation on Netlify broken (and I can't understand what is happening) support	7	902	December 2, 2020
Unable to successfully run "hugo server" in Visual Studio Code support	1	663	December 16, 2022
[Snap] Pipeline error with PostCSS (environment issue?) support	12	1723	August 29, 2018

Security error with the new 0.161.0 security for PostCSS

Related topics