[BUG] npm install npm error Cannot read properties of null (reading 'edgesOut')

[Jora28]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

This is not just a request to bump a dependency for a CVE

• This is not solely a request to bump a dependency for a CVE

Current Behavior

3835 verbose stack TypeError: Cannot read properties of null (reading 'edgesOut')
3835 verbose stack at #loadPeerSet (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:1289:38)
3835 verbose stack at async #loadPeerSet (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:1297:11)
3835 verbose stack at async #buildDepStep (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:904:11)
3835 verbose stack at async Arborist.buildIdealTree (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/build-ideal-tree.js:181:7)
3835 verbose stack at async Promise.all (index 1)
3835 verbose stack at async Arborist.reify (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/reify.js:131:5)
3835 verbose stack at async Install.exec (/usr/lib/node_modules/npm/lib/commands/install.js:150:5)
3835 verbose stack at async Npm.exec (/usr/lib/node_modules/npm/lib/npm.js:207:9)
3835 verbose stack at async module.exports (/usr/lib/node_modules/npm/lib/cli/entry.js:74:5)

{
"name": "nuxt-app",
"private": true,
"scripts": {
"dev": "nuxt dev",
"build": "nuxt build",
"analyze": "nuxt analyze --serve",
"generate": "nuxt generate",
"preview": "nuxt preview",
"postinstall": "nuxt prepare",
"generate-pwa-assets": "pwa-assets-generator",
"typecheck": "nuxt typecheck",
"lint": "eslint .",
"lint:fix": "eslint . --fix",
"prestart": "test -f .output/server/index.mjs || npm run build",
"start": "node .output/server/index.mjs",
"start:prod": "NODE_ENV=production node .output/server/index.mjs"
},
"engines": {
"node": ">=20.0.0"
},
"devDependencies": {
"@nuxt/eslint-config": "^1.15.2",
"@nuxtjs/device": "^3.2.4",
"@nuxtjs/google-fonts": "^3.2.0",
"@nuxtjs/i18n": "^9.5.3",
"@tailwindcss/aspect-ratio": "^0.4.2",
"@tailwindcss/forms": "^0.5.10",
"@types/lodash-es": "4.17.12",
"@vite-pwa/assets-generator": "^1.0.0",
"@vite-pwa/nuxt": "^1.0.0",
"autoprefixer": "^10.4.21",
"eslint": "^9.39.3",
"nuxt": "3.21.1",
"nuxt-gtag": "^3.0.2",
"nuxt-purgecss": "^2.0.0",
"postcss": "^8.5.1",
"tailwindcss": "^3.4.10"
},
"dependencies": {
"@headlessui/vue": "^1.7.23",
"@heroicons/vue": "^2.2.0",
"@microsoft/signalr": "^8.0.7",
"@nuxt/image": "^1.10.0",
"@pinia/nuxt": "^0.11.0",
"@tawk.to/tawk-messenger-vue-3": "^1.0.3",
"@vuepic/vue-datepicker": "^11.0.2",
"@vueuse/components": "^13.1.0",
"@vueuse/core": "^13.1.0",
"color": "^5.0.0",
"crypto-js": "^4.2.0",
"eventemitter3": "^5.0.1",
"gsap": "^3.12.7",
"lodash-es": "^4.17.21",
"lottie-web": "5.12.2",
"mersenne-twister": "^1.1.0",
"nuxt-toast": "^1.1.4",
"pinia": "^3.0.2",
"qrcode-vue3": "^1.7.1",
"sass": "^1.86.3",
"swiper": "^11.2.6",
"vue-chartjs": "^5.3.3",
"vue3-marquee": "^4.2.2",
"jsqr": "^1.4.0"
}
}
node v22.21.0
npm v10.8.2

Expected Behavior

No response

Steps To Reproduce

1. In this environment...
2. With this config...
3. Run '...'
4. See error...

Environment

• npm:
• Node.js:
• OS Name:
• System Model Name:
• npm config:

; copy and paste output from `npm config ls` here

[kchindam-infy]

@Jora28 I'm unable to reproduce the issue with the current information. Can you please share the exact steps to reproduce the issue. this looks to be similar if not a duplicate of an existing issue #8261

[Tkkg1994]

I hit this too and managed to reduce it to a one-dependency reproduction. Posting the details since the issue is currently marked as hard to reproduce.

Minimal reproduction

{
  "name": "repro",
  "version": "1.0.0",
  "private": true,
  "dependencies": {
    "@vitejs/devtools": "*"
  }
}

npm install --package-lock-only

npm error Cannot read properties of null (reading 'edgesOut')

Same crash site as the original report (#loadPeerSet, build-ideal-tree.js:1289). No lock file and no node_modules needed — it fails during ideal-tree construction.

The trigger is the range, not the resolved version

This is the part I found most interesting. All three resolve to the same version (0.4.2), but only the wildcard crashes:

@vitejs/devtools range	npm 10.9.8
"*"	Cannot read properties of null (reading 'edgesOut')
"^0.4.2"	OK
"0.4.2"	OK

Verified deterministic — repeated in fresh directories with a clean cache state, consistently reproducible.

Version matrix

Manifest	npm 10.9.8 (arborist 8.0.5)	npm 11.18.0 (arborist 9.9.0)
{"@vitejs/devtools": "*"}	reading 'edgesOut' (build-ideal-tree.js:1289)	reading 'children' (place-dep.js:299)
{"nuxt": "3.21.1"}	reading 'edgesOut'	—
{"nuxt": "4.5.0"}	reading 'edgesOut'	OK
{"@nuxt/vite-builder": "4.5.0"}	reading 'edgesOut'	OK
{"vite": "*"}	OK	OK

Two notes on npm 11: it still crashes on the isolated @vitejs/devtools case, just with a different null dereference. But on a larger real-world manifest that pulls @vitejs/devtools in transitively it resolved fine (1070 packages), presumably because the surrounding constraints keep the graph from reaching the bad state. So npm 11 is not a general fix here.

Why it's null

build-ideal-tree.js:1289 in arborist 8.0.5 is:

const parentEdge = node.parent.edgesOut.get(edge.name)

so node.parent is null. The stack shows #loadPeerSet recursing into itself (line 1297 → 1289), i.e. the node gets detached from its parent partway through recursive peer-set resolution and is then dereferenced unguarded. The npm 11 failure is the same shape one layer over — virtualRoot.children at place-dep.js:299 with a null virtualRoot.

The likely reason @vitejs/devtools provokes it is its peer block — four optional peers that are self-referential siblings at the same version, plus a wildcard:

"peerDependencies": {
  "vite": "*",
  "@vitejs/devtools-rolldown": "^0.4.2",
  "@vitejs/devtools-vite": "^0.4.2",
  "@vitejs/devtools-vitest": "^0.4.2",
  "@vitejs/devtools-oxc": "^0.4.2"
},
"peerDependenciesMeta": {
  "@vitejs/devtools-oxc":      { "optional": true },
  "@vitejs/devtools-rolldown": { "optional": true },
  "@vitejs/devtools-vite":     { "optional": true },
  "@vitejs/devtools-vitest":   { "optional": true }
}

Each of those sub-packages installs cleanly on its own; only the parent that declares the optional-sibling peer set crashes.

Why Nuxt users are the ones reporting this

nuxt → @nuxt/vite-builder → @vitejs/devtools. Since npm auto-installs peers, anything that peer-depends on @nuxt/schema or nuxt drags the whole builder toolchain in. {"nuxt": "3.21.1"} — the version in the original report — reproduces the exact edgesOut error as a single dependency on npm 10.

I ran into it in a different context: a Nuxt/Nitro server bundle that externalises a package peer-depending on @nuxt/schema, deployed to Firebase Cloud Functions. The Node 22 buildpack ships npm 10, so the deploy build died with this error while a local npm 11 install of the same manifest succeeded.

Workaround

Skipping peer auto-install avoids it, since none of that tooling is needed at runtime:

# .npmrc
legacy-peer-deps=true

Confirmed: {"@vitejs/devtools": "*"} goes from crash to OK on npm 10.9.8 with that set. Pinning the offending package to an exact or caret range instead of * also works, where you control the range.

Environment

npm:  10.9.8 (arborist 8.0.5) — crashes
npm:  11.18.0 (arborist 9.9.0) — crashes differently on the isolated case
Node: v24.15.0
OS:   Windows 11 (26200); also reproduces on the Linux Node 22 GCP buildpack

@vitejs/devtools resolved to 0.4.2 at time of testing — noting it since the * range is what makes this reproduce, so future registry state may shift which version you land on.

[AswinDhurai01]

@Jora28 Actually, I also faced this issue. This issue is resolved by updating the nodejs and npm version to their latest versions.
Upgraded Node.js (v22.21.1 → v24.x) and npm (v10.9.4 → v11.x), resolving the npm install failure.