{"record":{"id":"29f9788628083727","repo":"projectdiscovery/nuclei","slug":"cannot-use-unsafe-with-http-fuzzing-templates","errorCode":null,"errorMessage":"cannot use unsafe with http fuzzing templates","messagePattern":"cannot use unsafe with http fuzzing templates","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/http/http.go","lineNumber":518,"sourceCode":"\t\t\tunusedPayloads[payload] = struct{}{}\n\t\t}\n\t}\n\tfor payload := range unusedPayloads {\n\t\tdelete(request.Payloads, payload)\n\t}\n\n\tif len(request.Payloads) > 0 {\n\t\trequest.generator, err = generators.New(request.Payloads, request.AttackType.Value, request.options.TemplatePath, request.options.Catalog, request.options.Options.AttackType, request.options.Options)\n\t\tif err != nil {\n\t\t\treturn errors.Wrap(err, \"could not parse payloads\")\n\t\t}\n\t}\n\trequest.options = options\n\trequest.totalRequests = request.Requests()\n\n\tif len(request.Fuzzing) > 0 {\n\t\tif request.Unsafe {\n\t\t\treturn errors.New(\"cannot use unsafe with http fuzzing templates\")\n\t\t}\n\t\tfor _, rule := range request.Fuzzing {\n\t\t\tif fuzzingMode := options.Options.FuzzingMode; fuzzingMode != \"\" {\n\t\t\t\trule.Mode = fuzzingMode\n\t\t\t}\n\t\t\tif fuzzingType := options.Options.FuzzingType; fuzzingType != \"\" {\n\t\t\t\trule.Type = fuzzingType\n\t\t\t}\n\t\t\tif err := rule.Compile(request.generator, request.options); err != nil {\n\t\t\t\treturn errors.Wrap(err, \"could not compile fuzzing rule\")\n\t\t\t}\n\t\t}\n\t}\n\tif len(request.Payloads) > 0 {\n\t\t// Due to a known issue (https://github.com/projectdiscovery/nuclei/issues/5015),\n\t\t// dynamic extractors cannot be used with payloads. To address this,\n\t\t// execution is handled by the standard engine without concurrency,\n\t\t// achieved by setting the thread count to 0.","sourceCodeStart":500,"sourceCodeEnd":536,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/http/http.go#L500-L536","documentation":"HTTP fuzzing templates cannot use the unsafe raw-request serializer (`unsafe: true`); the fuzzing engine needs full request parsing/rebuild, which the unsafe path skips. When a request block declares both a fuzzing section and unsafe, Compile rejects it.","triggerScenarios":"An HTTP request block containing both `unsafe: true` and a `fuzzing:` section. Typically happens when a raw unsafe template is extended with a fuzzing block or vice versa.","commonSituations":"Merging features from two working templates; authors enabling unsafe to 'fix' raw-request quirks and then adding fuzz payloads; copy-paste template assembly.","solutions":["Remove `unsafe: true` from the request that carries the fuzzing block","If the raw request genuinely needs lenient parsing, fix the raw request itself (proper CRLFs, headers) instead of using unsafe","Keep fuzzing templates as normal raw requests — fuzzing works without unsafe"],"exampleFix":"# before\nhttp:\n  - raw:\n      - |\n        GET /?q={{payload}} HTTP/1.1\n    unsafe: true\n    fuzzing:\n      - type: replace\n\n# after\nhttp:\n  - raw:\n      - |\n        GET /?q={{payload}} HTTP/1.1\n    fuzzing:\n      - type: replace","handlingStrategy":"validation","validationCode":"if len(request.Fuzzing) > 0 && request.Unsafe {\n    return errors.New(\"template mixes unsafe: true with a fuzzing block — remove one\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Keep fuzzing templates in a separate directory from unsafe raw templates","Treat unsafe and fuzzing as mutually exclusive when authoring or merging templates"],"tags":["http","fuzzing","template","unsafe"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}