{"record":{"id":"b4c5bcec861b16c7","repo":"projectdiscovery/nuclei","slug":"no-host-header-found","errorCode":null,"errorMessage":"no host header found","messagePattern":"no host header found","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/protocols/http/raw/raw.go","lineNumber":342,"sourceCode":"\t\t\tnewLineIndex += hostHeaderIndex + 2\n\t\t\t// insert custom headers\n\t\t\tbuf := bufferPool.Get().(*bytes.Buffer)\n\t\t\tbuf.Reset()\n\t\t\tbuf.Write(r.UnsafeRawBytes[:newLineIndex])\n\t\t\tfor _, header := range headers {\n\t\t\t\tbuf.WriteString(header)\n\t\t\t\tbuf.WriteString(\"\\r\\n\")\n\t\t\t}\n\t\t\tbuf.Write(r.UnsafeRawBytes[newLineIndex:])\n\t\t\tr.UnsafeRawBytes = append([]byte(nil), buf.Bytes()...)\n\t\t\tbuf.Reset()\n\t\t\tbufferPool.Put(buf)\n\t\t\treturn nil\n\t\t}\n\t\treturn errors.New(\"no new line found at the end of host header\")\n\t}\n\n\treturn errors.New(\"no host header found\")\n}\n\n// ApplyAuthStrategy applies the auth strategy to the request\nfunc (r *Request) ApplyAuthStrategy(strategy authx.AuthStrategy) {\n\tif strategy == nil {\n\t\treturn\n\t}\n\tswitch s := strategy.(type) {\n\tcase *authx.QueryAuthStrategy:\n\t\tparsed, err := urlutil.Parse(r.FullURL)\n\t\tif err != nil {\n\t\t\tgologger.Error().Msgf(\"auth strategy failed to parse url: %s got %v\", r.FullURL, err)\n\t\t\treturn\n\t\t}\n\t\tfor _, p := range s.Data.Params {\n\t\t\tparsed.Params.Add(p.Key, p.Value)\n\t\t}\n\t\tr.FullURL = parsed.String()","sourceCodeStart":324,"sourceCodeEnd":360,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/protocols/http/raw/raw.go#L324-L360","documentation":"The companion error to 'no new line found at the end of host header': during raw-request header rewriting, nuclei first searches for a Host header; if none exists anywhere in the raw request, there is nothing to rewrite/inject against and this error is returned. HTTP/1.1 requests require a Host header, so the raw request is considered malformed.","triggerScenarios":"A raw request template whose header block has no `Host:` line at all, e.g. only 'GET / HTTP/1.1' followed by other headers, while the code path requires locating and rewriting Host.","commonSituations":"Hand-crafting minimal raw requests and forgetting Host; deleting the Host line assuming {{BaseURL}} substitution makes it unnecessary.","solutions":["Add a Host header line, typically `Host: {{Hostname}}`, as the first header of the raw request","Include the mandatory blank line after all headers","Validate the template with nuclei -validate before scanning"],"exampleFix":"# before\n- raw:\n    - |\n      GET / HTTP/1.1\n      Accept: */*\n\n# after\n- raw:\n    - |\n      GET / HTTP/1.1\n      Host: {{Hostname}}\n      Accept: */*\n","handlingStrategy":"validation","validationCode":"func hasHostHeader(raw string) bool {\n    for _, line := range strings.Split(raw, \"\\n\") {\n        if strings.HasPrefix(strings.ToLower(strings.TrimSpace(line)), \"host:\") {\n            return true\n        }\n    }\n    return false\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Make `Host: {{Hostname}}` the first header of every raw request template","Treat a raw request without a Host header as invalid HTTP/1.1 from the start"],"tags":["http","raw-request","template","host-header"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}