{"record":{"id":"5b284b2eeb5a2c28","repo":"projectdiscovery/nuclei","slug":"regex-extractor-group-must-be-0-got-d","errorCode":null,"errorMessage":"regex extractor group must be >= 0, got %d","messagePattern":"regex extractor group must be >= 0, got (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/operators/extractors/compile.go","lineNumber":24,"sourceCode":"\t\"strings\"\n\n\t\"github.com/itchyny/gojq\"\n\t\"github.com/projectdiscovery/govaluate\"\n\t\"github.com/projectdiscovery/nuclei/v3/pkg/operators/cache\"\n\t\"github.com/projectdiscovery/nuclei/v3/pkg/operators/common/dsl\"\n)\n\n// CompileExtractors performs the initial setup operation on an extractor\nfunc (e *Extractor) CompileExtractors() error {\n\t// Set up the extractor type\n\tcomputedType, err := toExtractorTypes(e.GetType().String())\n\tif err != nil {\n\t\treturn fmt.Errorf(\"unknown extractor type specified: %s\", e.Type)\n\t}\n\te.extractorType = computedType\n\n\tif e.extractorType == RegexExtractor && e.RegexGroup < 0 {\n\t\treturn fmt.Errorf(\"regex extractor group must be >= 0, got %d\", e.RegexGroup)\n\t}\n\n\t// Compile the regexes\n\tfor _, regex := range e.Regex {\n\t\tif cached, err := cache.Regex().GetIFPresent(regex); err == nil && cached != nil {\n\t\t\te.regexCompiled = append(e.regexCompiled, cached)\n\t\t\tcontinue\n\t\t}\n\t\tcompiled, err := regexp.Compile(regex)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"could not compile regex: %s\", regex)\n\t\t}\n\t\t_ = cache.Regex().Set(regex, compiled)\n\t\te.regexCompiled = append(e.regexCompiled, compiled)\n\t}\n\tfor i, kval := range e.KVal {\n\t\te.KVal[i] = strings.ToLower(kval)\n\t}","sourceCodeStart":6,"sourceCodeEnd":42,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/operators/extractors/compile.go#L6-L42","documentation":"Template compilation error from Extractor.CompileExtractors (pkg/operators/extractors/compile.go:24). For regex extractors only, the `group:` field (RegexGroup, the capture-group index used to extract a subgroup) must be >= 0; the default regexp convention in nuclei uses 0 for the full match. A negative value is rejected because regexp.MatchString-style subgroup access with a negative index is meaningless.","triggerScenarios":"An extractor with `type: regex` plus `group: -1` (sometimes written intending 'all groups' or a Python-style negative index), or a templating arithmetic mistake that renders group as a negative number.","commonSituations":"Copy-paste from PoC code using Python re semantics (group -1 = last group); attempting to reference the whole match and mistakenly writing -1 instead of omitting group or using 0; YAML anchors merging unexpected values.","solutions":["Remove `group:` entirely if you want the full regex match (group 0 behavior)","Set `group: 0` for the whole match or `group: N` for an existing capture group N (>= 1)","Count capture parentheses in the regex to confirm the intended group index exists","Validate with `nuclei -validate -t template.yaml` before deployment"],"exampleFix":"# before\nextractors:\n  - type: regex\n    regex:\n      - 'id=([0-9]+)'\n    group: -1\n# after\nextractors:\n  - type: regex\n    regex:\n      - 'id=([0-9]+)'\n    group: 1","handlingStrategy":"validation","validationCode":"if ex.Type != nil && ex.GetType() == ea.RegexExtractor && ex.RegexGroup < 0 {\n\treturn fmt.Errorf(\"rejecting template: regex extractor group %d < 0\", ex.RegexGroup)\n}","typeGuard":"func validRegexGroup(group int) bool { return group >= 0 }","tryCatchPattern":"// let CompileExtractors surface it, but map to author-friendly text:\nif err := ex.CompileExtractors(); err != nil && strings.Contains(err.Error(), \"regex extractor group\") {\n\treturn fmt.Errorf(\"template %s: fix 'group:' (must be >= 0)\", tplPath)\n}","preventionTips":["Omit group when the full match is wanted; use 0 explicitly if clearer","Never use Python-style negative group indices","Lint templates in CI with -validate to catch this pre-scan"],"tags":["extractor","regex","template","compile-time","validation"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}