crowdsecurity/crowdsec · error

target is down: %w

Error message

target is down: %w

What it means

After parsing the nuclei target URL, RunWithNucleiTemplate checks the extracted host with IsAlive; if the target application is not reachable the test aborts with this error. The test requires both the crowdsec AppSec engine and the vulnerable target app to be up.

Source

Thrown at pkg/hubtest/hubtest_item.go:396

		if err2 != nil {
			log.Errorf("unable to read crowdsec log file '%s': %s", crowdsecLogFile, err)
		} else {
			log.Errorf("crowdsec log file '%s'", crowdsecLogFile)
			log.Errorf("%s\n", string(crowdsecLog))
		}

		return fmt.Errorf("appsec is down: %w", err)
	}

	// check if the target is available
	nucleiTargetParsedURL, err := url.Parse(t.NucleiTargetHost)
	if err != nil {
		return fmt.Errorf("unable to parse target '%s': %w", t.NucleiTargetHost, err)
	}

	nucleiTargetHost := nucleiTargetParsedURL.Host
	if _, err = IsAlive(ctx, nucleiTargetHost); err != nil {
		return fmt.Errorf("target is down: %w", err)
	}

	nucleiConfig := NucleiConfig{
		Path:      "nuclei",
		OutputDir: t.RuntimePath,
		CmdLineOptions: []string{
			"-ev",    // allow variables from environment
			"-nc",    // no colors in output
			"-dresp", // dump response
			"-j",     // json output
		},
	}

	// the value in config is relative
	nucleiTemplate := filepath.Join(t.Path, t.Config.NucleiTemplate)

	err = nucleiConfig.RunNucleiTemplate(ctx, t.Name, nucleiTemplate, t.NucleiTargetHost)
	if errors.Is(err, ErrNucleiRunFail) {

View on GitHub (pinned to 909b515798)

Solutions

1. Start the test's target application before running the hub test
2. Confirm the host:port extracted from NucleiTargetHost matches where the target actually listens (curl it manually)
3. Check the target container/process logs for startup crashes
4. If running in CI, ensure services are healthy/wait-for conditions before tests

if err := waitReachable(targetHost, 30*time.Second); err != nil { t.Skipf("target app not up: %v", err) }

When it happens

Trigger: IsAlive(ctx, nucleiTargetHost) fails: the test's target application container/service is not started, is listening on a different interface/port, or crashed.

Common situations: Forgot to start the test's dummy/vulnerable app (e.g. docker compose service); target bound to localhost while config uses another hostname; port collision; target container exited on startup.

Understand the failure class

Background: ECONNREFUSED and "connection refused" / "could not connect to server" errors: what they mean and how to fix them — this error's family across 44 libraries.

Related errors

• appsec is down: %w
• error connecting to websocket
• ErrNucleiTemplateFail
• ErrNucleiRunFail
• while describing group %s: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/da1f60db97af559e. Report an issue: GitHub.