What causes "Regexp filter or matcher (-fr / -mr): invalid value: %s" in ffuf/ffuf?

Fix the regex to be valid Go/RE2 syntax (no lookaheads, backreferences, or possessive quantifiers)

Regexp filter or matcher (-fr / -mr): invalid value: %s

Error message

Regexp filter or matcher (-fr / -mr): invalid value: %s

What it means

NewRegexpFilter (pkg/filter/regex.go:20) compiles the user-supplied value as a Go regular expression for the -fr/-mr filter or matcher. If regexp.Compile fails (the pattern is not valid RE2 syntax), the constructor returns this error instead of a RegexpFilter. It exists so invalid CLI input fails fast with the offending value in the message.

Source

Thrown at pkg/filter/regex.go:20

import (
	"encoding/json"
	"fmt"
	"regexp"
	"strings"

	"github.com/ffuf/ffuf/v2/pkg/ffuf"
)

type RegexpFilter struct {
	Value    *regexp.Regexp
	valueRaw string
}

func NewRegexpFilter(value string) (ffuf.FilterProvider, error) {
	re, err := regexp.Compile(value)
	if err != nil {
		return &RegexpFilter{}, fmt.Errorf("Regexp filter or matcher (-fr / -mr): invalid value: %s", value)
	}
	return &RegexpFilter{Value: re, valueRaw: value}, nil
}

func (f *RegexpFilter) MarshalJSON() ([]byte, error) {
	return json.Marshal(&struct {
		Value string `json:"value"`
	}{
		Value: f.valueRaw,
	})
}

func (f *RegexpFilter) Filter(response *ffuf.Response) (bool, error) {
	matchheaders := ""
	for k, v := range response.Headers {
		for _, iv := range v {
			matchheaders += k + ": " + iv + "\r\n"
		}

View on GitHub (pinned to 33c67d28c8)

Solutions

Fix the regex to be valid Go/RE2 syntax (no lookaheads, backreferences, or possessive quantifiers)
Verify the pattern compiles standalone with a quick `go run` calling regexp.Compile, or `go fmt`-adjacent tools like regex101 with the Golang flavor
Check shell quoting: single-quote the pattern so backslashes and brackets survive
Escape metacharacters properly if you meant to match literal parentheses or brackets

Example fix

// before
ffuf.FilterProvider, err := NewRegexpFilter("foo(?=bar)") // lookahead: invalid in RE2
// after
ffuf.FilterProvider, err := NewRegexpFilter("foobar") // or restructure without lookahead

Defensive patterns

Strategy: validation

Validate before calling

import "regexp"

func isValidRegexp(value string) bool {
	_, err := regexp.Compile(value)
	return err == nil
}
// if !isValidRegexp(userValue) { reject before NewRegexpFilter }

Try / catch

if _, err := NewRegexpFilter(value); err != nil {
	return fmt.Errorf("-fr/-mr rejected: %w", err)
}

Prevention

Validate the pattern with regexp.Compile (Go/RE2) before passing it to ffuf
Avoid PCRE-only features: lookarounds, backreferences, possessive quantifiers
Single-quote regex arguments in shells so backslashes and brackets survive
Test the pattern in a Golang-flavored regex tool before using it in the CLI

When it happens

Trigger: Calling NewRegexpFilter(value) or NewFilterByName("regexp", value) / NewFilterByName("matcher", value) with a string that regexp.Compile rejects, e.g. unbalanced '(' or '[', a bad escape like '\\q', or an invalid repeat like '*'.

Common situations: Typing a PCRE-only construct (lookahead (?=...), backreferences) into -fr on the ffuf command line; shell quoting stripping or mangling backslashes; copying a regex from another language whose syntax Go's RE2 does not support.

Related errors

AI-assisted analysis of ffuf/ffuf@33c67d28c8 (2026-09-04). Data as JSON: /api/errors/c804fe038dbb2f5a. Report an issue: GitHub.