What causes "dialers not initialized for %s" in projectdiscovery/nuclei?

Run the template through the nuclei engine so protocolstate dialers are created at execution start

dialers not initialized for %s

Error message

dialers not initialized for %s

What it means

All kerberos KDC traffic is routed through per-execution dialers held in protocolstate (fastdialer plus connection history). GetDialersWithId(executionId) returned nil, meaning no dialers were ever initialized for this execution ID, so the TCP send path aborts before any network I/O happens.

Source

Thrown at pkg/js/libs/kerberos/sendtokdc.go:73

		// if it related to udp
		bin, err := CheckKrbError(response)
		if err == nil {
			return string(bin), nil
		}
	}
	return string(response), err
}

// sendToKDCTcp sends a message to the KDC via TCP.
func sendToKDCTcp(kclient *Client, msg string) ([]byte, error) {
	_, kdcs, err := kclient.Krb5Config.GetKDCs(kclient.Realm, true)
	kclient.nj.HandleError(err, "error getting KDCs")
	kclient.nj.Require(len(kdcs) > 0, "no KDCs found")

	executionId := kclient.nj.ExecutionId()
	dialers := protocolstate.GetDialersWithId(executionId)
	if dialers == nil {
		return nil, fmt.Errorf("dialers not initialized for %s", executionId)
	}

	dialCtx := kclient.nj.Context()
	var errs []string
	for i := 1; i <= len(kdcs); i++ {
		host, port, err := net.SplitHostPort(kdcs[i])
		if err == nil && kclient.config.ip != "" {
			// use that ip address instead of realm/domain for resolving
			host = kclient.config.ip
		}
		tcpConn, err := dialers.Fastdialer.Dial(dialCtx, "tcp", net.JoinHostPort(host, port))
		if err != nil {
			errs = append(errs, fmt.Sprintf("error establishing connection to %s: %v", kdcs[i], err))
			continue
		}
		defer func() {
			_ = tcpConn.Close()
		}()

View on GitHub (pinned to 265b3a3dec)

Solutions

Run the template through the nuclei engine so protocolstate dialers are created at execution start
When embedding via lib/nuclei, ensure the executor/engine is initialized before any JavaScript library call
Do not cache Client instances or defer SendToKDC calls beyond the lifetime of one execution

Defensive patterns

Strategy: try-catch

Try / catch

try {
  const resp = kerberos.SendToKDC(client, msg);
} catch (e) {
  // dialers missing for this execution: run inside a nuclei scan execution, do not cache clients across runs
}

Prevention

Run kerberos library calls only inside a live nuclei scan execution
When embedding via lib/nuclei, initialize the engine before executing JS templates
Keep client creation and SendToKDC within one execution lifetime

When it happens

Trigger: Invoking the kerberos library from a standalone goja runtime or unit test where protocolstate was never set up; calling SendToKDC after the scan execution context was torn down; caching a Client across separate scan executions and reusing it later.

Common situations: Embedding nuclei via lib/nuclei and running JS libs before engine initialization; long-lived scripts that outlive their execution ID; tests that construct the client directly instead of running through the engine.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d78b099a3875d000. Report an issue: GitHub.