VLESS settings: unsupported "decryption": ` + config.Decrypt

Error message

VLESS settings: unsupported "decryption": ` + config.Decryption

What it means

If a VLESS outbound sets "decryption" to something other than "none" (and not matching the special embedded seed/padding prefix format that the inline lambda strips), the value is unsupported and the build fails with the offending value echoed in the message. VLESS deliberately has no encryption/decryption at the protocol settings level.

Source

Thrown at infra/conf/vless.go:154

			if len(r) < 20 {
				padding += len(r) + 1
				continue
			}
			if b, _ := base64.RawURLEncoding.DecodeString(r); len(b) != 32 && len(b) != 64 {
				return false
			}
		}
		config.Decryption = config.Decryption[27+len(s[2]):]
		if padding > 0 {
			config.Padding = config.Decryption[:padding-1]
			config.Decryption = config.Decryption[padding:]
		}
		return true
	}() && config.Decryption != "none" {
		if config.Decryption == "" {
			return nil, errors.New(`VLESS settings: please add/set "decryption":"none" to every settings`)
		}
		return nil, errors.New(`VLESS settings: unsupported "decryption": ` + config.Decryption)
	}

	if config.Decryption != "none" && c.Fallbacks != nil {
		return nil, errors.New(`VLESS settings: "fallbacks" can not be used together with "decryption"`)
	}

	for _, fb := range c.Fallbacks {
		var i uint16
		var s string
		if err := json.Unmarshal(fb.Dest, &i); err == nil {
			s = strconv.Itoa(int(i))
		} else {
			_ = json.Unmarshal(fb.Dest, &s)
		}
		config.Fallbacks = append(config.Fallbacks, &inbound.Fallback{
			Name: fb.Name,
			Alpn: fb.Alpn,
			Path: fb.Path,

View on GitHub (pinned to 7d214f8b09)

Solutions

Set "decryption": "none" — the only supported plain value
Remove any VMess-style encryption settings from the VLESS outbound

Example fix

// before
"settings": { "decryption": "auto", ... }
// after
"settings": { "decryption": "none", ... }

Defensive patterns

Strategy: validation

Validate before calling

d := gjson.Get(outbound, "settings.decryption").String()
if d != "none" {
    return fmt.Errorf("vless decryption must be \"none\", got %q", d)
}

Prevention

Never reuse VMess security values in VLESS settings
Treat "none" as the only valid decryption literal

When it happens

Trigger: "decryption": "auto", "decryption": "aes-128-gcm", or any string other than "none" in VLESS outbound settings.

Common situations: Copy-pasting VMess-style security values into VLESS, or assuming decryption mirrors the outbound 'encryption' field of the client user.

Related errors

AI-assisted analysis of XTLS/Xray-core@7d214f8b09 (2026-08-15). Data as JSON: /api/errors/1f9e7420f5bb7f47. Report an issue: GitHub.