[▲ Vercel Community](/) · [Categories](/categories) · [Latest](/latest) · [Top](/top) · [Live](/live) [Feedback](/c/feedback/8) # Builder returned invalid routes: should NOT be longer than 4096 char 163 views · 2 likes · 4 posts Dick de Leeuw (@ddeleeuw) · 2025-05-01 · ♥ 1 It's very much the same discussion as [#8676](https://github.com/vercel/vercel/discussions/8676), albeit with a new insight. I've also posted this in GitHub discussions at https://github.com/vercel/vercel/discussions/13283 My codebase has an extensive Content Security Policy (CSP) setup. I.e. many HTTP headers. Vercel is therefore giving the error 'Builder returned invalid routes: should NOT be longer than 4096 characters' during Vercel builds. Please consider this discussion as a feature request and opportunity to help others. * I would expect this error to happen on localhost in a `next build` since the Vercel-Next.js relation is strong. * My solution was to relax the CSP config. Instead of listing hardcoded domains, I've basically reverted to a 'allow most' setup. I think Vercel's technical setup should NOT reduce security. The reason for the many CPS entries is the Google Tag Manager requirement to list all Google TLDs. See https://developers.google.com/tag-platform/security/guides/csp#google_analytics_4_google_analytics Amy Egan (@amyegan) · 2025-05-01 · ♥ 1 Hey @ddeleeuw. I moved this topic over to #feedback and shared with the team Matthewlant 8923 (@matthewlant-8923) · 2025-06-24 I have the exact same issue. curious, how did you implement an "allow most" setup for your CSP config? @ddeleeuw Dick de Leeuw (@ddeleeuw) · 2025-06-25 Hi Matthew, So instead of listing all Google TLDs in the `connect-src` directive, I've reverted the entries to just `'self'` and `'https:'`. Since I use [`next-secure-headers`](https://www.npmjs.com/package/next-secure-headers), this is the full directive: ```ts // Be advised, if we configure connectSrc in a strict setup, we need all // Google TLDs in here, making the header list too long for usage on Vercel. // @see https://community.vercel.com/t/builder-returned-invalid-routes-should-not-be-longer-than-4096-char/9624 connectSrc: ["'self'", 'https:', ...(process.env.NODE_ENV === 'development' ? ['http:'] : [])], ```