{"record":{"id":"765b4fe50d339e88","repo":"projectdiscovery/nuclei","slug":"proxy-denied-by-network-policy","errorCode":null,"errorMessage":"proxy denied by network policy","messagePattern":"proxy denied by network policy","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/libs/goexec/errors.go","lineNumber":18,"sourceCode":"package goexec\n\nimport \"errors\"\n\nvar (\n\tErrMissingAuth             = errors.New(\"goexec auth is required\")\n\tErrMissingUsername         = errors.New(\"goexec username is required for this auth mode\")\n\tErrMultipleCredentialModes = errors.New(\"goexec auth selects multiple primary credential modes\")\n\tErrMissingTarget           = errors.New(\"goexec target is required\")\n\tErrMissingCommand          = errors.New(\"goexec command is required\")\n\tErrMissingExecutable       = errors.New(\"goexec executable is required\")\n\tErrUnsupportedModule       = errors.New(\"unsupported goexec module\")\n\tErrUnsupportedMethod       = errors.New(\"unsupported goexec method\")\n\tErrUnsupportedOutputMethod = errors.New(\"unsupported goexec output method\")\n\tErrNetworkPolicyDenied     = errors.New(\"target denied by network policy\")\n\tErrInvalidMethodArguments  = errors.New(\"invalid goexec method arguments\")\n\tErrDomainControllerDenied  = errors.New(\"domain controller denied by network policy\")\n\tErrProxyDenied             = errors.New(\"proxy denied by network policy\")\n\tErrEndpointDenied          = errors.New(\"endpoint denied by network policy\")\n)\n","sourceCodeStart":1,"sourceCodeEnd":21,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/libs/goexec/errors.go#L1-L21","documentation":"Sentinel error from the goexec helper. When options.proxy is set, proxyAllowed() parses the proxy URI and checks its hostname against protocolstate.IsHostAllowed (adapter_goexec.go:44-46, 387-393). A policy-disallowed proxy hostname stops the run with ErrProxyDenied. Note the lenient edge: a proxy URI that fails to parse or has an empty hostname is allowed through, so this error specifically means the proxy host was resolved and denied.","triggerScenarios":"goexec request with options: {proxy: 'http://10.10.10.1:8080'} while the policy excludes 10.10.10.1; any proxy whose hostname resolves into a denied CIDR.","commonSituations":"Internal pivot proxies on subnets the policy does not cover; corporate proxy IPs added after the policy was written.","solutions":["Allow the proxy host/IP in the network policy","Remove the proxy option and connect directly if policy permits the target","Verify with protocolstate.IsHostAllowed on the parsed proxy hostname before the run"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"func proxyCheck(proxyURI string) error {\n    u, err := url.Parse(proxyURI)\n    if err != nil || u.Hostname() == \"\" { return nil } // adapter allows these\n    if !protocolstate.IsHostAllowed(executionID, u.Hostname()) {\n        return errors.New(\"proxy host blocked by network policy\")\n    }\n    return nil\n}","typeGuard":"func isProxyDenied(err error) bool { return errors.Is(err, goexec.ErrProxyDenied) }","tryCatchPattern":null,"preventionTips":["Pre-parse proxy URLs and policy-check hostnames","Keep the proxy allow list in sync with infrastructure changes"],"tags":["goexec","network-policy","proxy"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}