projectdiscovery/nuclei · error

malformed request supplied

Error message

malformed request supplied

What it means

Error "malformed request supplied" thrown in projectdiscovery/nuclei.

Source

Thrown at pkg/protocols/http/build_request.go:342

	// If the request is a raw request, get the URL from the request
	// header and use it to make the request.
	if isRawRequest {
		// Get the hostname from the URL section to build the request.
		reader := bufio.NewReader(strings.NewReader(data))
	read_line:
		s, err := reader.ReadString('\n')
		if err != nil {
			return nil, fmt.Errorf("could not read request: %w", err)
		}

		// ignore all annotations
		if stringsutil.HasPrefixAny(s, "@") {
			goto read_line
		}

		parts := strings.Split(s, " ")
		if len(parts) < 3 {
			return nil, fmt.Errorf("malformed request supplied")
		}

		if err := expressions.ContainsUnresolvedVariables(parts[1]); err != nil && !r.request.SkipVariablesCheck {
			return nil, errkit.Newf("unresolved variables `%v` found in request", parts[1])
		}

		parsed, err := urlutil.ParseURL(parts[1], true)
		if err != nil {
			return nil, fmt.Errorf("could not parse request URL: %w", err)
		}
		// self-contained requests choose their own destination URL, so validate
		// that host against the network policy.
		if err := r.validateSelfContainedHost(parsed.Hostname()); err != nil {
			return nil, err
		}
		values = generators.MergeMaps(
			generators.MergeMaps(dynamicValues, protocolutils.GenerateVariables(parsed, false, nil)),
			values,

View on GitHub (pinned to 265b3a3dec)

When it happens

Trigger: Thrown at pkg/protocols/http/build_request.go:342 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/891742f747ca4c44. Report an issue: GitHub.