projectdiscovery/nuclei · error

empty input provided for fuzzing

Error message

empty input provided for fuzzing

What it means

The fuzzing execution path in request_fuzz.go requires a concrete target: either a URL string in input.MetaInput.Input or a full HTTP request supplied via input.MetaInput.ReqResp (raw request target file). If both are empty there is nothing to fuzz, so it errors before generating any fuzzed request. Note this only runs after ShouldFuzzTarget already passed, so the template applies but the input is blank.

Source

Thrown at pkg/protocols/http/request_fuzz.go:55

func (request *Request) executeFuzzingRule(input *contextargs.Context, previous output.InternalEvent, callback protocols.OutputEventCallback) error {
	// methdology:
	// to check applicablity of rule, we first try to execute it with one value
	// if it is applicable, we execute all requests
	// if it is not applicable, we log and fail silently

	// check if target should be fuzzed or not
	if !request.ShouldFuzzTarget(input) {
		urlx, _ := input.MetaInput.URL()
		if urlx != nil {
			gologger.Verbose().Msgf("[%s] fuzz: target(%s) not applicable for fuzzing\n", request.options.TemplateID, urlx.String())
		} else {
			gologger.Verbose().Msgf("[%s] fuzz: target(%s) not applicable for fuzzing\n", request.options.TemplateID, input.MetaInput.Input)
		}
		return nil
	}

	if input.MetaInput.Input == "" && input.MetaInput.ReqResp == nil {
		return errors.New("empty input provided for fuzzing")
	}

	// ==== fuzzing when full HTTP request is provided =====

	if input.MetaInput.ReqResp != nil {
		baseRequest, err := input.MetaInput.ReqResp.BuildRequest()
		if err != nil {
			return errors.Wrap(err, "fuzz: could not build request obtained from target file")
		}
		request.addHeadersToRequest(baseRequest)
		input.MetaInput.Input = baseRequest.String()
		// execute with one value first to checks its applicability
		err = request.executeAllFuzzingRules(input, previous, baseRequest, callback)
		if err != nil {
			// in case of any error, return it
			if fuzz.IsErrRuleNotApplicable(err) {
				// log and fail silently
				gologger.Verbose().Msgf("[%s] fuzz: %s\n", request.options.TemplateID, err)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Provide a valid URL target, or pass a raw request file as the target so ReqResp gets populated
2. Sanitize input lists (remove blank lines) before feeding nuclei
3. In SDK code, guard: skip execution when both Input and ReqResp are empty

if input.MetaInput.Input == "" && input.MetaInput.ReqResp == nil {
    return nil // skip empty fuzzing input instead of erroring
}

When it happens

Trigger: Running a fuzzing template with an empty target: blank line in the -l list, an unset CI variable, or SDK code calling ExecuteWithResults with Input == "" and no ReqResp populated.

Common situations: Target lists with trailing/blank lines; automation passing an empty string by mistake; SDK users forgetting to populate either MetaInput.Input or MetaInput.ReqResp.

Related errors

• input cannot be empty file or folder expected
• cannot use unsafe with http fuzzing templates
• could not create request: no request in request response
• could not create request: %s
• dialers not initialized for execution id: {ExecutionId}

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/b1ba3b2971ec6f50. Report an issue: GitHub.