projectdiscovery/nuclei · error

invalid host or port

Error message

invalid host or port

What it means

Returned by BuildDSN when MySQLOptions.Host is empty or MySQLOptions.Port is <= 0 — the two mandatory fields for a TCP DSN. BuildDSN is called internally by Connect/ExecuteQuery (which supply host/port) but is also exported for direct use from JS, where forgetting to populate the options struct is easy. All later defaults (protocol tcp→nucleitcp, DbName) are applied only after this check passes.

Source

Thrown at pkg/js/libs/mysql/mysql_private.go:49

		Password string // Password is the password used to authenticate with the MySQL server.
		DbName   string // DbName is the name of the database to connect to on the MySQL server.
		RawQuery string // QueryStr is the query string to append to the DSN (ex: "?tls=skip-verify").
		Timeout  int    // Timeout is the timeout in seconds for the connection to the MySQL server.
	}
)

// BuildDSN builds a MySQL data source name (DSN) from the given options.
// @example
// ```javascript
// const mysql = require('nuclei/mysql');
// const options = new mysql.MySQLOptions();
// options.Host = 'acme.com';
// options.Port = 3306;
// const dsn = mysql.BuildDSN(options);
// ```
func BuildDSN(opts MySQLOptions) (string, error) {
	if opts.Host == "" || opts.Port <= 0 {
		return "", fmt.Errorf("invalid host or port")
	}
	if opts.Protocol == "" {
		opts.Protocol = "tcp"
	}
	// We're going to use a custom dialer when creating MySQL connections, so if we've been
	// given "tcp" as the protocol, then quietly switch it to "nucleitcp", which we have
	// already registered.
	if opts.Protocol == "tcp" {
		opts.Protocol = "nucleitcp"
	}
	if opts.DbName == "" {
		opts.DbName = "/"
	} else {
		opts.DbName = "/" + opts.DbName
	}
	target := net.JoinHostPort(opts.Host, fmt.Sprintf("%d", opts.Port))
	var dsn strings.Builder
	fmt.Fprintf(&dsn, "%v:%v", url.QueryEscape(opts.Username), opts.Password)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Set Host and a valid Port (1-65535) on MySQLOptions before calling BuildDSN
2. Validate inputs derived from extractors/variables before building the DSN
3. Prefer the convenience APIs Connect/ExecuteQuery which take host/port arguments directly and are harder to get wrong
4. Add a guard clause in the template: if (!opts.Host || !(opts.Port > 0)) skip

Example fix

// before
const opts = new mysql.MySQLOptions();
opts.Username = 'root';
const dsn = mysql.BuildDSN(opts); // invalid host or port

// after
const opts = new mysql.MySQLOptions();
opts.Host = 'acme.com';
opts.Port = 3306;
opts.Username = 'root';
const dsn = mysql.BuildDSN(opts);

if (!opts.Host || !(opts.Port > 0) || opts.Port > 65535) {
  throw new Error('host and port required before BuildDSN');
}
const dsn = mysql.BuildDSN(opts);

function isValidTarget(host, port) {
  return typeof host === 'string' && host.length > 0 && Number.isInteger(port) && port > 0 && port <= 65535;
}

try { mysql.BuildDSN(opts); } catch (e) { if (String(e) === 'invalid host or port') { /* fix opts and rebuild */ } else { throw e; } }

When it happens

Trigger: Constructing mysql.MySQLOptions in JS and calling mysql.BuildDSN(opts) without setting opts.Host or with opts.Port left at the zero value / set to 0 or a negative number. Also a port parsed from untrusted input that yields 0 or NaN.

Common situations: JS templates that build options dynamically from extractor output (empty host match); copy-paste from the doc example that only sets Username/Password; passing a port as string into the int field; iterating targets where some entries have no port.

Related errors

• cannot use IP address as DNS input
• input cannot be empty file or folder expected
• empty input provided for fuzzing
• parse target: %w
• invalid host or port

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d43bd871aa3e4233. Report an issue: GitHub.