projectdiscovery/nuclei · error

cannot use unsafe with http fuzzing templates

Error message

cannot use unsafe with http fuzzing templates

What it means

HTTP fuzzing templates cannot use the unsafe raw-request serializer (`unsafe: true`); the fuzzing engine needs full request parsing/rebuild, which the unsafe path skips. When a request block declares both a fuzzing section and unsafe, Compile rejects it.

Source

Thrown at pkg/protocols/http/http.go:518

			unusedPayloads[payload] = struct{}{}
		}
	}
	for payload := range unusedPayloads {
		delete(request.Payloads, payload)
	}

	if len(request.Payloads) > 0 {
		request.generator, err = generators.New(request.Payloads, request.AttackType.Value, request.options.TemplatePath, request.options.Catalog, request.options.Options.AttackType, request.options.Options)
		if err != nil {
			return errors.Wrap(err, "could not parse payloads")
		}
	}
	request.options = options
	request.totalRequests = request.Requests()

	if len(request.Fuzzing) > 0 {
		if request.Unsafe {
			return errors.New("cannot use unsafe with http fuzzing templates")
		}
		for _, rule := range request.Fuzzing {
			if fuzzingMode := options.Options.FuzzingMode; fuzzingMode != "" {
				rule.Mode = fuzzingMode
			}
			if fuzzingType := options.Options.FuzzingType; fuzzingType != "" {
				rule.Type = fuzzingType
			}
			if err := rule.Compile(request.generator, request.options); err != nil {
				return errors.Wrap(err, "could not compile fuzzing rule")
			}
		}
	}
	if len(request.Payloads) > 0 {
		// Due to a known issue (https://github.com/projectdiscovery/nuclei/issues/5015),
		// dynamic extractors cannot be used with payloads. To address this,
		// execution is handled by the standard engine without concurrency,
		// achieved by setting the thread count to 0.

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Remove `unsafe: true` from the request that carries the fuzzing block
2. If the raw request genuinely needs lenient parsing, fix the raw request itself (proper CRLFs, headers) instead of using unsafe
3. Keep fuzzing templates as normal raw requests — fuzzing works without unsafe

Example fix

# before
http:
  - raw:
      - |
        GET /?q={{payload}} HTTP/1.1
    unsafe: true
    fuzzing:
      - type: replace

# after
http:
  - raw:
      - |
        GET /?q={{payload}} HTTP/1.1
    fuzzing:
      - type: replace

if len(request.Fuzzing) > 0 && request.Unsafe {
    return errors.New("template mixes unsafe: true with a fuzzing block — remove one")
}

When it happens

Trigger: An HTTP request block containing both `unsafe: true` and a `fuzzing:` section. Typically happens when a raw unsafe template is extended with a fuzzing block or vice versa.

Common situations: Merging features from two working templates; authors enabling unsafe to 'fix' raw-request quirks and then adding fuzz payloads; copy-paste template assembly.

Related errors

• probe concurrency must be at least 1
• response read size must be non-negative
• empty filename
• invalid attack type: %s
• Invalid HTTP method verb: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/29f9788628083727. Report an issue: GitHub.