{"record":{"id":"d2ebe5cecd922539","repo":"projectdiscovery/nuclei","slug":"panic-s","errorCode":null,"errorMessage":"panic: %s","messagePattern":"panic: (.+?)","errorType":"panic","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/js/compiler/session.go","lineNumber":149,"sourceCode":"func (s *session) prepareCommon() {\n\ts.commonPrepared = true\n\n\ts.config.runtime.ClearInterrupt()\n\t_ = s.config.runtime.Set(\"template\", s.config.args.TemplateCtx)\n\tfor k, v := range s.config.args.Args {\n\t\t_ = s.config.runtime.Set(k, v)\n\t}\n\n\ts.config.runtime.SetContextValue(\"executionId\", s.config.opts.ExecutionId)\n\ts.config.runtime.SetContextValue(\"ctx\", s.config.ctx)\n\tenableRequire(s.config.runtime)\n}\n\nfunc (s *session) start() {\n\tgo func() {\n\t\tdefer func() {\n\t\t\tif r := recover(); r != nil {\n\t\t\t\ts.resultChan <- gojaRunResult{err: fmt.Errorf(\"panic: %s\", r)}\n\t\t\t}\n\t\t}()\n\n\t\tresult, err := s.config.runtime.RunProgram(s.config.program)\n\t\ts.resultChan <- gojaRunResult{result: result, err: err}\n\t}()\n}\n\nfunc (s *session) wait() (gojaRunResult, error) {\n\tselect {\n\tcase <-s.config.ctx.Done():\n\t\tcontextErr := s.config.ctx.Err()\n\t\ts.config.runtime.Interrupt(contextErr)\n\n\t\ttimer := time.NewTimer(time.Second)\n\t\tdefer timer.Stop()\n\n\t\tselect {","sourceCodeStart":131,"sourceCodeEnd":167,"githubUrl":"https://github.com/projectdiscovery/nuclei/blob/265b3a3dec374741614e342f813c10f8b38d2bb7/pkg/js/compiler/session.go#L131-L167","documentation":"A Go-level panic escaped while goja executed the template's JavaScript program; session.start()'s goroutine recovers it and converts r into this error on the result channel. It means a native Go binding (a libs/* function), goja internals, or runtime state crashed — not a JS exception, which surfaces as a normal error.","triggerScenarios":"A code-protocol template calling a native helper that panics: nil map/index dereference in Go, assertion failure in a binding, concurrent runtime misuse. The recover() in session.go:143 is the only thing keeping the process alive.","commonSituations":"Bugs in a specific nuclei version's JS bindings (fixed in later releases); templates exercising newly added libs; SDK embedding that reuses one runtime across goroutines.","solutions":["Note the template/executionId that hit it and disable that template (-et / remove from path)","Update nuclei to the latest release — native panics are bugs and get patched","Reproduce with the template standalone (nuclei -t that-template -u target -v) and report at github.com/projectdiscovery/nuclei/issues including the panic value"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"In template JS, wrap risky native calls in try/catch to convert ordinary failures into handled errors — this does NOT catch Go panics, which arrive as the recovered 'panic: ...' error from Execute; at the Go level, check the returned error, log executionId/template path, exclude the template, and continue the scan.","preventionTips":["Keep nuclei updated — recovered native panics are fixed upstream","Pin template versions in CI so a bad template cannot take down scheduled scans","Report the panic value plus the template ID to projectdiscovery/nuclei"],"tags":["javascript","goja","panic","runtime"],"backgroundTag":null,"analyzedSha":"265b3a3dec374741614e342f813c10f8b38d2bb7","analyzedAt":"2026-08-15T20:05:51.855Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}