What causes "failed to load templates: %w" in projectdiscovery/nuclei?

Validate the referenced template standalone: `nuclei -validate -t `

failed to load templates: %w

Error message

failed to load templates: %w

What it means

Inside the lazy dynamic-secrets callback (internal/runner/lazy.go:72), TemplateStore.LoadTemplates([]string{d.TemplatePath}) failed and the loader error is wrapped as 'failed to load templates'. Load failure means parse/compile problems in the referenced auth template (invalid YAML, unknown fields, operator compile errors) — a merely missing path produces the separate 'no templates found' error instead. The %w cause carries the underlying parse/compile detail.

Source

Thrown at internal/runner/lazy.go:72

	opts.ExcludeIds = nil
	opts.Protocols = nil
	opts.ExcludeProtocols = nil
	opts.IncludeConditions = nil
	cfg := loader.NewConfig(opts, catalog, execOpts)
	cfg.StoreId = loader.AuthStoreId
	store, err := loader.New(cfg)
	if err != nil {
		return nil, errkit.Wrap(err, "failed to initialize dynamic auth templates store")
	}
	return store, nil
}

// GetLazyAuthFetchCallback returns a lazy fetch callback for auth secrets
func GetLazyAuthFetchCallback(opts *AuthLazyFetchOptions) authx.LazyFetchSecret {
	return func(d *authx.Dynamic) error {
		tmpls, err := opts.TemplateStore.LoadTemplates([]string{d.TemplatePath})
		if err != nil {
			return fmt.Errorf("failed to load templates: %w", err)
		}
		if len(tmpls) == 0 {
			return fmt.Errorf("%w for path: %s", disk.ErrNoTemplatesFound, d.TemplatePath)
		}
		if len(tmpls) > 1 {
			return fmt.Errorf("multiple templates found for path: %s", d.TemplatePath)
		}
		data := map[string]interface{}{}
		tmpl := tmpls[0]
		// add args to tmpl here
		vars := map[string]interface{}{}
		mainCtx := context.Background()
		ctx := scan.NewScanContext(mainCtx, contextargs.NewWithInput(mainCtx, d.Input))

		cliVars := map[string]interface{}{}
		if opts.ExecOpts.Options != nil {
			// gets variables passed from cli -v and -env-vars
			cliVars = generators.BuildPayloadFromOptions(opts.ExecOpts.Options)

View on GitHub (pinned to 265b3a3dec)

Solutions

Validate the referenced template standalone: `nuclei -validate -t <TemplatePath>`
Fix the parse/compile error reported by the wrapped %w cause
Keep auth templates under the same templates root the store was built from
Re-validate auth templates after nuclei upgrades

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-validate the auth template before registering the dynamic secret
if err := exec.Command("nuclei", "-validate", "-t", d.TemplatePath).Run(); err != nil {
    return fmt.Errorf("auth template %s fails validation", d.TemplatePath)
}

Try / catch

tmpls, err := opts.TemplateStore.LoadTemplates([]string{d.TemplatePath})
if err != nil {
    return fmt.Errorf("cannot load auth template %s (validate it standalone): %w", d.TemplatePath, err)
}

Prevention

Run nuclei -validate on auth templates in CI
Re-validate after nuclei upgrades to catch schema drift
Keep auth templates in the store's templates root

When it happens

Trigger: A dynamic secret whose TemplatePath references a template that fails to parse or compile under the current nuclei version; auth templates edited with syntax errors; schema drift after upgrades breaking previously-valid templates.

Common situations: Custom auth templates drifting from the current schema after nuclei upgrades; hand-edits introducing YAML/DSL errors; templates relying on removed fields.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/9d3806ffb9d62a13. Report an issue: GitHub.