VLESS settings: "fallbacks" can not be used together with "d

Error message

VLESS settings: "fallbacks" can not be used together with "decryption"

What it means

VLESS outbound fallbacks are only meaningful when decryption is "none" (fallbacks dispatch un-decrypted first-packet traffic). If both a non-"none" decryption and a "fallbacks" array are present, the combination is contradictory and rejected.

Source

Thrown at infra/conf/vless.go:158

			if b, _ := base64.RawURLEncoding.DecodeString(r); len(b) != 32 && len(b) != 64 {
				return false
			}
		}
		config.Decryption = config.Decryption[27+len(s[2]):]
		if padding > 0 {
			config.Padding = config.Decryption[:padding-1]
			config.Decryption = config.Decryption[padding:]
		}
		return true
	}() && config.Decryption != "none" {
		if config.Decryption == "" {
			return nil, errors.New(`VLESS settings: please add/set "decryption":"none" to every settings`)
		}
		return nil, errors.New(`VLESS settings: unsupported "decryption": ` + config.Decryption)
	}

	if config.Decryption != "none" && c.Fallbacks != nil {
		return nil, errors.New(`VLESS settings: "fallbacks" can not be used together with "decryption"`)
	}

	for _, fb := range c.Fallbacks {
		var i uint16
		var s string
		if err := json.Unmarshal(fb.Dest, &i); err == nil {
			s = strconv.Itoa(int(i))
		} else {
			_ = json.Unmarshal(fb.Dest, &s)
		}
		config.Fallbacks = append(config.Fallbacks, &inbound.Fallback{
			Name: fb.Name,
			Alpn: fb.Alpn,
			Path: fb.Path,
			Type: fb.Type,
			Dest: s,
			Xver: fb.Xver,
		})

View on GitHub (pinned to 7d214f8b09)

Solutions

Remove the "fallbacks" array from the outbound, or
Keep fallbacks only with "decryption": "none" — note fallbacks normally belong to the inbound side; move them there

Example fix

// before
"settings": { "decryption": "auto", "fallbacks": [ ... ] }
// after
"settings": { "decryption": "none" }  // fallbacks removed from outbound (use inbound fallbacks)

Defensive patterns

Strategy: validation

Validate before calling

d := gjson.Get(outbound, "settings.decryption").String()
hasFallbacks := len(gjson.Get(outbound, "settings.fallbacks").Array()) > 0
if hasFallbacks && d != "none" {
    return errors.New("fallbacks require decryption=none (and normally belong on the inbound)")
}

Prevention

Remember fallbacks are an inbound feature; don't copy them into outbounds
Validate mutual exclusivity of decryption and fallbacks in config linters

When it happens

Trigger: A VLESS outbound with "decryption": "auto" (or the special embedded format leaving a non-none value) together with a non-empty "fallbacks" array.

Common situations: Copying a server-side inbound fallbacks block into the outbound settings, or leftover fallbacks after changing decryption for testing.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/622ea4b76875539a. Report an issue: GitHub.