A merchant is experiencing an issue where customers can purchase products despite inventory being set to 0, with “continue selling when out of stock” disabled and inventory tracking enabled.
Initial troubleshooting:
The standard Shopify setting to prevent out-of-stock purchases has been verified as properly configured
Support suggested checking for third-party apps that might be interfering with inventory controls
Root cause identified:
A user discovered this appears to be a platform-level bug with the cart validation logic:
The frontend only disables the “Add to Cart” button via CSS and a disabled attribute, which isn’t foolproof
Backend API validation fails to verify stock levels when requests bypass browser-based JavaScript validation
Demonstrated that sending a direct XHR/fetch request to the cart API successfully adds out-of-stock items to the basket
Alternative purchase buttons (Apple Pay, Google Pay) may also bypass these client-side restrictions
Current status:
The issue remains unresolved. The validation relies solely on client-side checks, allowing technically savvy users or automated systems to circumvent stock controls by making direct API calls.
Summarized with AI on November 14.
AI used: claude-sonnet-4-5-20250929.
Customers have been able to purchase items that have been out of stock for some days despite the inventory being ‘0’ and the “continue selling..” option on the product page being unmarked.
What are other ways to prevent customers from purchasing products sold out/out of stock?
I believe this is a genuine bug with the platform, the add to cart button is still in the source code with a property of disabled=disabled on the button attribute and some css to hide it. Basically that’s not a full proof way of preventing that form from being submitted. Then there’s the other buy now button that loads the default payment gateway for your chosen payment service, so apple pay or Google. If you send a call to the backend api and add an out of stock product. What happens ?
I’ve just tested this and the logic in the backend does not account for the product being out of stock if the request bypasses the javascript validation in the browser. It can’t be a bug In the theme files because the server is processing this request.
The product in question has 0 stock, continue selling without stock is disabled and as above the track inventory is also checked. Open the browser on the customer facing view open the console and send an xhr request using a simple fetch…
var x = {
form_type: “product”,
utf8: “✓”,
“options[Colour]”: “Grey”,
“quantity”: “02”,
“id”: 43315643973789,
“product-id”: 7686496190621,
Refresh the page the out of stock product is now in the basket. Therefore this theory confirms the validation on the client side is failing allowing people to still add to cart of out if stock.