projectdiscovery/nuclei · warning

http: response body exceeds %d bytes

Error message

http: response body exceeds %d bytes

What it means

The response body was larger than MaxBodyBytes (default 5 MiB): the body is read through io.LimitReader(MaxBodyBytes+1) and a read that exceeds the cap aborts instead of returning a truncated body. This bounds per-request memory in JS templates; the whole request fails even though headers were received.

Source

Thrown at pkg/js/libs/http/http.go:356

	if req.Header.Get("User-Agent") == "" {
		req.Header.Set("User-Agent", "Nuclei")
	}

	resp, err := httpClient.Do(req)
	if err != nil {
		return nil, err
	}
	defer func() {
		_ = resp.Body.Close()
	}()

	limited := io.LimitReader(resp.Body, int64(c.MaxBodyBytes)+1)
	raw, err := io.ReadAll(limited)
	if err != nil {
		return nil, err
	}
	if len(raw) > c.MaxBodyBytes {
		return nil, fmt.Errorf("http: response body exceeds %d bytes", c.MaxBodyBytes)
	}

	out := &Response{
		StatusCode: resp.StatusCode,
		URL:        resp.Request.URL.String(),
		Body:       string(raw),
		Headers:    flattenHeaders(resp.Header),
		header:     resp.Header.Clone(),
	}
	return out, nil
}

func executionIDFrom(ctx context.Context, c *Client) string {
	if c != nil && c.nj != nil {
		if id := c.nj.ExecutionId(); id != "" {
			return id
		}
	}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Raise the cap to match the asset: const o = new http.Options(); o.MaxBodyBytes = 20 * 1024 * 1024;
2. Use HEAD requests when only status/headers matter
3. Treat the error as a signal: 'body exceeds N bytes' can itself be the detection condition for large-file exposure

Example fix

// before: default 5 MiB cap, artifact endpoint returns far more
const resp = client.Get('https://repo.acme.com/pkg/latest.rpm'); // -> exceeds 5242880 bytes

// after: size the cap to the expected asset
const o = new http.Options();
o.MaxBodyBytes = 100 * 1024 * 1024;
const client = new http.Client(o);
const resp = client.Get('https://repo.acme.com/pkg/latest.rpm');

const o = new http.Options();
o.MaxBodyBytes = 100 * 1024 * 1024; // size the cap to the largest asset you intend to read
const client = new http.Client(o);

let resp;
try {
  resp = client.Get(url);
} catch (e) {
  if (/response body exceeds/.test(e.message || '')) {
    // either retry with a larger MaxBodyBytes client, treat as large-content signal, or switch to HEAD
  }
}

When it happens

Trigger: Hitting file downloads, ISOs, packages, or large JSON/XML exports with the default 5 MiB cap; Options.MaxBodyBytes configured lower than the target's normal response size; streaming endpoints that emit unbounded payloads.

Common situations: Templates checking artifact repositories (npm/maven/oci manifests), sitemap.xml or dump endpoints; bandwidth-conscious scans lowering MaxBodyBytes; using the error itself as a big-content detector.

Related errors

• http: stopped after %d redirects
• http: executionId not set
• http: invalid url: %w
• http: url must include scheme and host
• dialers not initialized for %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/f21dbea49bda1113. Report an issue: GitHub.