case-insensitive flag is supported only for 'kval' extractor

Error message

case-insensitive flag is supported only for 'kval' extractors (not '%s')

What it means

Template compilation error from Extractor.CompileExtractors (pkg/operators/extractors/compile.go:71). `case-insensitive: true` is only implemented for kval extractors (keys are lowercased at compile time, lines 41–43, and again at 71–76). Setting it on any other extractor type is rejected instead of being silently ignored.

Source

Thrown at pkg/operators/extractors/compile.go:71

		e.jsonCompiled = append(e.jsonCompiled, compiled)
	}

	for _, dslExp := range e.DSL {
		if cached, err := cache.DSL().GetIFPresent(dslExp); err == nil && cached != nil {
			e.dslCompiled = append(e.dslCompiled, cached)
			continue
		}
		compiled, err := govaluate.NewEvaluableExpressionWithFunctions(dslExp, dsl.HelperFunctions)
		if err != nil {
			return &dsl.CompilationError{DslSignature: dslExp, WrappedError: err}
		}
		_ = cache.DSL().Set(dslExp, compiled)
		e.dslCompiled = append(e.dslCompiled, compiled)
	}

	if e.CaseInsensitive {
		if e.GetType() != KValExtractor {
			return fmt.Errorf("case-insensitive flag is supported only for 'kval' extractors (not '%s')", e.Type)
		}
		for i := range e.KVal {
			e.KVal[i] = strings.ToLower(e.KVal[i])
		}
	}

	return nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

For regex/dsl: implement case-insensitivity in the expression itself — '(?i)pattern' for regex or to_lower(...) in DSL
For kval: keep `case-insensitive: true` and ensure `type: kval`
Remove the flag from non-kval extractors to restore compilation
Validate with `nuclei -validate -t template.yaml`

Example fix

# before
extractors:
  - type: regex
    case-insensitive: true
    regex:
      - 'Root: '
# after
extractors:
  - type: regex
    regex:
      - '(?i)root: '

Defensive patterns

Strategy: validation

Validate before calling

if ex.CaseInsensitive && ex.GetType() != ea.KValExtractor {
	return fmt.Errorf("case-insensitive only valid on kval extractors, got %v", ex.Type)
}

Type guard

func caseInsensitiveAllowed(t string) bool { return strings.ToLower(strings.TrimSpace(t)) == "kval" }

Try / catch

if err := ex.CompileExtractors(); err != nil && strings.Contains(err.Error(), "case-insensitive flag is supported only") {
	// drop the flag and bake (?i)/to_lower into the pattern/expression instead
}

Prevention

Remember: extractor flag => kval only; matcher flag => word only
Use (?i) for regex and to_lower() for DSL instead of the flag
Run -validate to catch copy-paste type flips

When it happens

Trigger: An extractor with `type: regex`/`dsl`/`json`/`xpath` that also sets `case-insensitive: true`.

Common situations: Copy-pasting a kval extractor and changing only `type:`; trying to make a word/regex match case-insensitive using the matcher-style flag on the wrong object; templates authored against older nuclei that tolerated the flag.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/dfcdb697b812ab47. Report an issue: GitHub.