projectdiscovery/nuclei · error

no fuzz values specified

Error message

no fuzz values specified

What it means

Returned by fuzz.Rule.executeRuleValues (pkg/fuzz/execute.go) when a fuzzing rule is executed against a request component but carries no payloads: the template's `fuzz:` payload block (a SliceOrMapSlice on the rule, fuzz/fuzz.go:92) parsed into neither a string list (rule.Fuzz.Value) nor a key:value map (rule.Fuzz.KV). With nothing to substitute into the fuzzed parameter/header/cookie, nuclei cannot build a mutated request and aborts the rule with this error.

Source

Thrown at pkg/fuzz/execute.go:451

			if gotErr != nil {
				return gotErr
			}

			req, err := ruleComponent.Rebuild()
			if err != nil {
				return err
			}

			if gotErr := rule.execWithInput(input, req, input.InteractURLs, ruleComponent, "", "", "", "", "", ""); gotErr != nil {
				return gotErr
			}
		}

		return gotErr
	}

	// something else is wrong
	return fmt.Errorf("no fuzz values specified")
}

// Compile compiles a fuzzing rule and initializes it for operation
func (rule *Rule) Compile(generator *generators.PayloadGenerator, options *protocols.ExecutorOptions) error {
	// If a payload generator is specified from base request, use it
	// for payload values.
	if generator != nil {
		rule.generator = generator
	}
	rule.options = options

	// Resolve the default enums
	if rule.Mode != "" {
		if valueType, ok := stringToModeType[rule.Mode]; !ok {
			return errors.Errorf("invalid mode value specified: %s", rule.Mode)
		} else {
			rule.modeType = valueType
		}

View on GitHub (pinned to 265b3a3dec)

Solutions

  1. Open the failing template and give the fuzz rule entry a `fuzz:` block containing either a list of strings or a key:value map
  2. Run `nuclei -validate -t <template.yaml>` to catch empty fuzz blocks before execution
  3. If payloads come from a generator (top-level payloads + attack), verify the payloads block exists on the request and actually yields values, since the generator feeds rule.Fuzz at Compile time
  4. When driving fuzz.Rule programmatically, assert len(rule.Fuzz.Value) > 0 || rule.Fuzz.KV != nil before calling Execute

Example fix

# before (fuzz rule with no payloads -> no fuzz values specified)
fuzz:
  - type: parameter
    param: username
    mode: single
    fuzz: []

# after
fuzz:
  - type: parameter
    param: username
    mode: single
    fuzz:
      - "'"
      - "admin'--"

# after (key:value form)
    fuzz:
      username: admin
      password: password
Defensive patterns

Strategy: validation

Validate before calling

for _, r := range fuzzRules {
    if len(r.Fuzz.Value) == 0 && r.Fuzz.KV == nil {
        return fmt.Errorf("fuzz rule on %q has no payloads; add a fuzz value list or key:value map", r.Param)
    }
}

Type guard

func fuzzRuleArmed(rule *fuzz.Rule) bool {
    return rule != nil && (len(rule.Fuzz.Value) > 0 || rule.Fuzz.KV != nil)
}

Try / catch

if err := rule.Execute(input); err != nil {
    if strings.Contains(err.Error(), "no fuzz values specified") {
        gologger.Warning().Msg("skipping unarmed fuzz rule")
        continue
    }
    return err
}

Prevention

When it happens

Trigger: Executing a fuzz template whose rule entry has an empty, null, or missing `fuzz:` payload list (the rule has param/mode/type but no payloads); creating a fuzz.Rule in Go and calling Execute without setting Fuzz and without a payload generator passed to Compile; a payloads/attack block that compiles but generates zero value combinations so Fuzz is never populated.

Common situations: Template author scaffolds a dast/fuzz block and forgets the payload list; YAML indentation drifts so the payload values sit under a sibling key and `fuzz:` itself is empty; payloads referenced via generator DSL but the base request has no payloads section so the generator is nil; editing a copied template and deleting the values.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/e6f039387e41e0c6. Report an issue: GitHub.