projectdiscovery/nuclei · error

http: invalid url: %w

Error message

http: invalid url: %w

What it means

url.Parse rejected the raw URL string: Go's parser fails on control characters, raw spaces in some positions, invalid percent-escapes, or other malformed input. The nuclei/http client requires a well-formed absolute URL before host policy can be evaluated, so it aborts with the parser's error wrapped.

Source

Thrown at pkg/js/libs/http/http.go:259

		FollowRedirects: true,
		MaxRedirects:    defaultMaxRedirects,
		TimeoutSeconds:  defaultTimeoutSeconds,
		MaxBodyBytes:    defaultMaxBodyBytes,
		headers:         make(http.Header),
	}
}

func (c *Client) do(ctx context.Context, method, rawURL, body string) (*Response, error) {
	c.init()

	executionID := executionIDFrom(ctx, c)
	if executionID == "" {
		return nil, fmt.Errorf("http: executionId not set")
	}

	parsed, err := url.Parse(rawURL)
	if err != nil {
		return nil, fmt.Errorf("http: invalid url: %w", err)
	}
	if parsed.Scheme == "" || parsed.Host == "" {
		return nil, fmt.Errorf("http: url must include scheme and host")
	}

	host := parsed.Hostname()
	if !protocolstate.IsHostAllowed(executionID, host) {
		return nil, protocolstate.ErrHostDenied.Msgf(host)
	}

	dialers := protocolstate.GetDialersWithId(executionID)
	if dialers == nil {
		return nil, fmt.Errorf("dialers not initialized for %s", executionID)
	}

	tlsConfig := &tls.Config{
		InsecureSkipVerify: true,
		MinVersion:         tls.VersionTLS10,

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Encode interpolated path/query parts with encodeURIComponent before building the URL
2. Trim whitespace/newlines from every variable used in a URL
3. Validate the URL shape with a regex before calling Get/Post/Request

Example fix

// before: raw extractor output with spaces
const resp = client.Get('https://example.com/' + extracted);

// after: trim and encode the interpolated part
const resp = client.Get('https://example.com/' + encodeURIComponent(extracted.trim()));

const u = String(rawUrl || '').trim();
if (/[\x00-\x1f]/.test(u) || /%(?![0-9a-fA-F]{2})/.test(u)) {
  throw new Error('URL contains control chars or broken percent-encoding');
}
const resp = client.Get(u);

const isParseableUrl = (u) => { const s = String(u || '').trim(); return s.length > 0 && !/[\x00-\x1f\s]/.test(s) && !/%(?![0-9a-fA-F]{2})/.test(s); };

try { const resp = client.Get(u); }
catch (e) { if (/http: invalid url/.test(e.message || '')) { /* trim + encode parts, rebuild the URL */ } }

When it happens

Trigger: URL containing raw spaces or control characters ('https://ex.com/a b'); broken percent-encoding ('https://ex.com/%zz'); passing a base64 blob, file path, or host:port string instead of a URL; trailing newline from a variables file.

Common situations: Interpolating extractor output into a URL without encoding; copy-pasting URLs with invisible characters; concatenating template variables that inject whitespace or line breaks.

Related errors

• http: url must include scheme and host
• ntlm: empty blob
• unsupported ldap url schema %v
• host concurrency must be at least 1
• headless template threads must be at least 1

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/026f3fc764460e55. Report an issue: GitHub.