What causes "failed to read body: %s" in projectdiscovery/nuclei?

Confirm you are on an unmodified nuclei release (this path is a no-op guard)

failed to read body: %s

Error message

failed to read body: %s

What it means

After headers, ParseRawRequest slurps the remaining body via buff.ReadFrom(protoReader.R) and any error other than io.EOF is wrapped here. The reader is a strings.Reader, so in the shipped code path this is practically unreachable; seeing it means a reader-level failure or a modified build.

Source

Thrown at pkg/input/types/http.go:297

		// read it off the URL: retryablehttp derives the wire Host from there,
		// and keeping it in the header map would expose it to header fuzzing as
		// if it were an ordinary header.
		if strings.EqualFold(key, "Host") {
			// an absolute request target takes precedence over the Host header
			if rr.URL.Host == "" {
				rr.URL.Host = value
			}
			continue
		}
		rr.Request.Headers.Set(key, value)
	}

	// parse body
	rr.Request.Body = ""
	var buff bytes.Buffer
	_, err = buff.ReadFrom(protoReader.R)
	if err != nil && err != io.EOF {
		return nil, fmt.Errorf("failed to read body: %s", err)
	}
	if buff.Len() > 0 {
		// yaml may include trailing newlines
		// remove them if present
		bin := buff.Bytes()
		if len(bin) > 0 && bin[len(bin)-1] == '\n' {
			bin = bin[:len(bin)-1]
		}
		if len(bin) > 0 && (bin[len(bin)-1] == '\r' || bin[len(bin)-1] == '\n') {
			bin = bin[:len(bin)-1]
		}
		rr.Request.Body = conversion.String(bin)
	}

	// set raw request
	rr.Request.Raw = raw
	return rr, nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

Confirm you are on an unmodified nuclei release (this path is a no-op guard)
If it reproduces on a fork, inspect what protoReader.R is backed by in that build
Shrink the raw request body to rule out resource exhaustion

Defensive patterns

Strategy: try-catch

Try / catch

Wrap ParseRawRequest and treat any body-read failure as fatal for that entry; with stock builds this is a should-never-happen guard, so if it fires, capture the raw input and report a bug.

Prevention

Run official releases; this path guards a strings.Reader that cannot fail
If you fork the parser, ensure your reader returns io.EOF at end of body

When it happens

Trigger: Calling ParseRawRequest in a fork/patched build where the reader can fail mid-stream; essentially never with the standard strings.Reader-based implementation.

Common situations: Custom builds wrapping the reader; out-of-memory conditions on enormous bodies; vendored forks that changed the input source.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/4314fd160f832a0a. Report an issue: GitHub.