What causes "could not create request: %s" in projectdiscovery/nuclei?

Use a valid HTTP method token in request.method (GET, POST, custom verbs like PROPFIND are fine)

could not create request: %s

Error message

could not create request: %s

What it means

BuildRequest() had a Request object but retryablehttp.NewRequestFromURL(rr.Request.Method, urlx, body) rejected it. The underlying %s is the retryablehttp error: usually an invalid HTTP method token or a nil/invalid URL (empty scheme or host after cloning rr.URL).

Source

Thrown at pkg/input/types/http.go:78

// BuildRequest builds a retryablehttp request from the request response
func (rr *RequestResponse) BuildRequest() (*retryablehttp.Request, error) {
	rr.once.Do(func() {
		// Request is optional: UnmarshalJSON only populates it when a "request"
		// key is present, so an entry carrying just a "url" leaves it nil.
		// Dereferencing it below would panic with a nil pointer instead of
		// surfacing a usable error, taking the whole scan down.
		if rr.Request == nil {
			rr.reqErr = fmt.Errorf("could not create request: no request in request response")
			return
		}
		urlx := rr.URL.Clone()
		var body io.Reader = nil
		if rr.Request.Body != "" {
			body = strings.NewReader(rr.Request.Body)
		}
		req, err := retryablehttp.NewRequestFromURL(rr.Request.Method, urlx, body)
		if err != nil {
			rr.reqErr = fmt.Errorf("could not create request: %s", err)
			return
		}
		rr.Request.Headers.Iterate(func(k, v string) bool {
			req.Header.Add(k, v)
			return true
		})
		if req.Header.Get("User-Agent") == "" {
			userAgent := useragent.PickRandom()
			req.Header.Set("User-Agent", userAgent.Raw)
		}
		rr.req = req
	})
	return rr.req, rr.reqErr
}

// To be implemented in the future
// func (rr *RequestResponse) BuildUnsafeRequest()

View on GitHub (pinned to 265b3a3dec)

Solutions

Use a valid HTTP method token in request.method (GET, POST, custom verbs like PROPFIND are fine)
Ensure the top-level "url" is absolute with scheme and host, e.g. https://example.com/api
Inspect the wrapped %s text: 'net/http: invalid method' points at the method, URL errors point at the url field

Example fix

// before
{"url": "example.com/api", "request": {"method": "GET /x"}}

// after
{"url": "https://example.com/api", "request": {"method": "GET"}}

Defensive patterns

Strategy: validation

Validate before calling

func validMethod(m string) bool {
    if m == "" { return false }
    for _, r := range m {
        if !(r >= 'A' && r <= 'Z' || r >= 'a' && r <= 'z' || r >= '0' && r <= '9' || strings.ContainsRune("!#$%&'*+.^_|~-", r)) {
            return false
        }
    }
    return true
}

if u, err := url.Parse(entry.URL); err != nil || u.Scheme == "" || u.Host == "" || !validMethod(entry.Request.Method) {
    // reject entry before it reaches BuildRequest
}

Try / catch

Catch the BuildRequest error and inspect the wrapped retryablehttp text: 'net/http: invalid method' → fix the method field; url errors → fix the url field; the same sync.Once caching caveat as error 181 applies.

Prevention

Always emit absolute URLs with scheme+host in generated input files
Restrict methods to standard tokens or vendor-approved custom verbs
Run a one-pass linter over JSON inputs before large scans

When it happens

Trigger: request.method containing spaces, control characters, or being empty; a "url" value that parsed into an URL without host/scheme so the cloned URL is unusable for request construction.

Common situations: Method set to "get x", "POST; charset=utf-8" or left empty in JSON input; url missing host ("/api/foo" stored as the top-level url field); upstream tooling exporting malformed HAR-like JSON.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/f153d1674a16c0bd. Report an issue: GitHub.