projectdiscovery/nuclei · error
Invalid HTTP method verb: %s
Error message
Invalid HTTP method verb: %s
What it means
The `method:` field of an HTTP request resolves through toHTTPMethodTypes, which trims and uppercases the value then matches it against HTTPMethodMapping. Supported verbs are GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PURGE and DEBUG; anything else fails template compilation with this message.
Source
Thrown at pkg/protocols/http/http_method_types.go:72
}
// GetSupportedHTTPMethodTypes returns list of supported types
func GetSupportedHTTPMethodTypes() []HTTPMethodType {
var result []HTTPMethodType
for index := HTTPMethodType(1); index < limit; index++ {
result = append(result, index)
}
return result
}
func toHTTPMethodTypes(valueToMap string) (HTTPMethodType, error) {
normalizedValue := normalizeValue(valueToMap)
for key, currentValue := range HTTPMethodMapping {
if normalizedValue == currentValue {
return key, nil
}
}
return -1, errors.New("Invalid HTTP method verb: " + valueToMap)
}
func normalizeValue(value string) string {
return strings.TrimSpace(strings.ToUpper(value))
}
func (t HTTPMethodType) String() string {
return HTTPMethodMapping[t]
}
// HTTPMethodTypeHolder is used to hold internal type of the HTTP Method
type HTTPMethodTypeHolder struct {
MethodType HTTPMethodType `mapping:"true"`
}
func (holder HTTPMethodTypeHolder) String() string {
return holder.MethodType.String()
}View on GitHub (pinned to 265b3a3dec)
Solutions
- Fix the verb to one of GET, HEAD, POST, PUT, DELETE, CONNECT, OPTIONS, TRACE, PATCH, PURGE, DEBUG
- For arbitrary/custom verbs, use a raw request block where the verb is written literally on the request line
Example fix
# before
http:
- method: PROPFIND
path: ["/"]
# after
http:
- raw:
- |
PROPFIND / HTTP/1.1
Host: {{Hostname}} Defensive patterns
Strategy: type-guard
Type guard
func isValidHTTPMethod(v string) bool {
_, ok := http.HTTPMethodMapping[...] // caller-side equivalent:
}
// simpler caller-side set:
var validMethods = map[string]bool{"GET":true,"HEAD":true,"POST":true,"PUT":true,
"DELETE":true,"CONNECT":true,"OPTIONS":true,"TRACE":true,"PATCH":true,"PURGE":true,"DEBUG":true}
func isValidHTTPMethod(method string) bool {
return validMethods[strings.ToUpper(strings.TrimSpace(method))]
} Prevention
- Limit `method:` to GET/HEAD/POST/PUT/DELETE/CONNECT/OPTIONS/TRACE/PATCH/PURGE/DEBUG
- For custom verbs (WebDAV etc.), write them literally in a raw request instead of the method field
- Validate templates with nuclei -validate to catch enum errors at authoring time
When it happens
Trigger: A typo like `method: GETS` / `method: gett`, or an unsupported custom verb such as `method: PROPFIND` or `method: REPORT` (WebDAV-style) in the `method:` field. Case is fine (normalized), the word itself must be in the table.
Common situations: Expecting arbitrary-verb support via the method field; porting curl commands with unusual verbs; typos during hand-editing.
Related errors
- invalid signature type:
- probe concurrency must be at least 1
- response read size must be non-negative
- empty filename
- Invalid action type: %s
AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15).
Data as JSON: /api/errors/17f5e1a21b499150.
Report an issue: GitHub.