{"record":{"id":"622ea4b76875539a","repo":"XTLS/Xray-core","slug":"vless-settings-fallbacks-can-not-be-used-togeth","errorCode":null,"errorMessage":"VLESS settings: \"fallbacks\" can not be used together with \"decryption\"","messagePattern":"VLESS settings: \"fallbacks\" can not be used together with \"decryption\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"infra/conf/vless.go","lineNumber":158,"sourceCode":"\t\t\tif b, _ := base64.RawURLEncoding.DecodeString(r); len(b) != 32 && len(b) != 64 {\n\t\t\t\treturn false\n\t\t\t}\n\t\t}\n\t\tconfig.Decryption = config.Decryption[27+len(s[2]):]\n\t\tif padding > 0 {\n\t\t\tconfig.Padding = config.Decryption[:padding-1]\n\t\t\tconfig.Decryption = config.Decryption[padding:]\n\t\t}\n\t\treturn true\n\t}() && config.Decryption != \"none\" {\n\t\tif config.Decryption == \"\" {\n\t\t\treturn nil, errors.New(`VLESS settings: please add/set \"decryption\":\"none\" to every settings`)\n\t\t}\n\t\treturn nil, errors.New(`VLESS settings: unsupported \"decryption\": ` + config.Decryption)\n\t}\n\n\tif config.Decryption != \"none\" && c.Fallbacks != nil {\n\t\treturn nil, errors.New(`VLESS settings: \"fallbacks\" can not be used together with \"decryption\"`)\n\t}\n\n\tfor _, fb := range c.Fallbacks {\n\t\tvar i uint16\n\t\tvar s string\n\t\tif err := json.Unmarshal(fb.Dest, &i); err == nil {\n\t\t\ts = strconv.Itoa(int(i))\n\t\t} else {\n\t\t\t_ = json.Unmarshal(fb.Dest, &s)\n\t\t}\n\t\tconfig.Fallbacks = append(config.Fallbacks, &inbound.Fallback{\n\t\t\tName: fb.Name,\n\t\t\tAlpn: fb.Alpn,\n\t\t\tPath: fb.Path,\n\t\t\tType: fb.Type,\n\t\t\tDest: s,\n\t\t\tXver: fb.Xver,\n\t\t})","sourceCodeStart":140,"sourceCodeEnd":176,"githubUrl":"https://github.com/XTLS/Xray-core/blob/7d214f8b094f75322fa3990f8aadad1c912f24f5/infra/conf/vless.go#L140-L176","documentation":"VLESS outbound fallbacks are only meaningful when decryption is \"none\" (fallbacks dispatch un-decrypted first-packet traffic). If both a non-\"none\" decryption and a \"fallbacks\" array are present, the combination is contradictory and rejected.","triggerScenarios":"A VLESS outbound with \"decryption\": \"auto\" (or the special embedded format leaving a non-none value) together with a non-empty \"fallbacks\" array.","commonSituations":"Copying a server-side inbound fallbacks block into the outbound settings, or leftover fallbacks after changing decryption for testing.","solutions":["Remove the \"fallbacks\" array from the outbound, or","Keep fallbacks only with \"decryption\": \"none\" — note fallbacks normally belong to the inbound side; move them there"],"exampleFix":"// before\n\"settings\": { \"decryption\": \"auto\", \"fallbacks\": [ ... ] }\n// after\n\"settings\": { \"decryption\": \"none\" }  // fallbacks removed from outbound (use inbound fallbacks)","handlingStrategy":"validation","validationCode":"d := gjson.Get(outbound, \"settings.decryption\").String()\nhasFallbacks := len(gjson.Get(outbound, \"settings.fallbacks\").Array()) > 0\nif hasFallbacks && d != \"none\" {\n    return errors.New(\"fallbacks require decryption=none (and normally belong on the inbound)\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Remember fallbacks are an inbound feature; don't copy them into outbounds","Validate mutual exclusivity of decryption and fallbacks in config linters"],"tags":["config","vless","outbound","fallback"],"backgroundTag":null,"analyzedSha":"7d214f8b094f75322fa3990f8aadad1c912f24f5","analyzedAt":"2026-08-15T14:26:24.325Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}