projectdiscovery/nuclei · error

js must be at least 1

Error message

js must be at least 1

What it means

Headless actions resolve each argument via getActionArg, which first runs ReplaceInteractshMarkers so OOB markers inside arguments get real URLs. If the interactsh client cannot allocate a URL, the failure is wrapped with the argument name - same root cause as the render-layer marker error, but surfaced per headless action argument.

Source

Thrown at lib/config.go:145

// WithConcurrency sets concurrency options
func WithConcurrency(opts Concurrency) NucleiSDKOptions {
	return func(e *NucleiEngine) error {
		// minimum required is 1
		if opts.TemplateConcurrency <= 0 {
			return errors.New("template threads must be at least 1")
		}
		if opts.HostConcurrency <= 0 {
			return errors.New("host concurrency must be at least 1")
		}
		if opts.HeadlessHostConcurrency <= 0 {
			return errors.New("headless host concurrency must be at least 1")
		}
		if opts.HeadlessTemplateConcurrency <= 0 {
			return errors.New("headless template threads must be at least 1")
		}
		if opts.JavascriptTemplateConcurrency <= 0 {
			return errors.New("js must be at least 1")
		}
		if opts.TemplatePayloadConcurrency <= 0 {
			return errors.New("payload concurrency must be at least 1")
		}
		if opts.ProbeConcurrency <= 0 {
			return errors.New("probe concurrency must be at least 1")
		}
		e.opts.TemplateThreads = opts.TemplateConcurrency
		e.opts.BulkSize = opts.HostConcurrency
		e.opts.HeadlessBulkSize = opts.HeadlessHostConcurrency
		e.opts.HeadlessTemplateThreads = opts.HeadlessTemplateConcurrency
		e.opts.JsConcurrency = opts.JavascriptTemplateConcurrency
		e.opts.PayloadConcurrency = opts.TemplatePayloadConcurrency
		e.opts.ProbeConcurrency = opts.ProbeConcurrency
		return nil
	}
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Check OAST server reachability from the scanning host and retry
2. Point -interactsh-server at a healthy or self-hosted instance
3. Remove the OOB marker from the headless argument if it is not required, or run with -no-interactsh

Example fix

# before
nuclei -t headless.yaml   # default OAST endpoint failing
# after
nuclei -t headless.yaml -interactsh-server https://oast.mycorp.com

val, err := getActionArg(action, "to")
if err != nil && strings.Contains(err.Error(), "could not replace interactsh marker") {
    // OAST allocation failure inside a headless argument: retry once
    time.Sleep(2 * time.Second)
    val, err = getActionArg(action, "to")
}
if err != nil {
    return err
}

When it happens

Trigger: A headless action argument embedding an interactsh marker (e.g. a navigate URL containing {{interactsh-url}}) while the OAST server is unreachable or the client is stopped.

Common situations: Egress-filtered environments blocking the OAST domain; self-hosted interactsh down; headless templates relying on out-of-band callbacks.

Related errors

• if a client certification option is provided, then all three
• max sleep count
• payload concurrency must be at least 1
• interactsh client not initialized
• Invalid action type: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/80c2bf2cb65953fa. Report an issue: GitHub.