projectdiscovery/nuclei · error

panic: %s

Error message

panic: %s

What it means

A Go-level panic escaped while goja executed the template's JavaScript program; session.start()'s goroutine recovers it and converts r into this error on the result channel. It means a native Go binding (a libs/* function), goja internals, or runtime state crashed — not a JS exception, which surfaces as a normal error.

Source

Thrown at pkg/js/compiler/session.go:149

func (s *session) prepareCommon() {
	s.commonPrepared = true

	s.config.runtime.ClearInterrupt()
	_ = s.config.runtime.Set("template", s.config.args.TemplateCtx)
	for k, v := range s.config.args.Args {
		_ = s.config.runtime.Set(k, v)
	}

	s.config.runtime.SetContextValue("executionId", s.config.opts.ExecutionId)
	s.config.runtime.SetContextValue("ctx", s.config.ctx)
	enableRequire(s.config.runtime)
}

func (s *session) start() {
	go func() {
		defer func() {
			if r := recover(); r != nil {
				s.resultChan <- gojaRunResult{err: fmt.Errorf("panic: %s", r)}
			}
		}()

		result, err := s.config.runtime.RunProgram(s.config.program)
		s.resultChan <- gojaRunResult{result: result, err: err}
	}()
}

func (s *session) wait() (gojaRunResult, error) {
	select {
	case <-s.config.ctx.Done():
		contextErr := s.config.ctx.Err()
		s.config.runtime.Interrupt(contextErr)

		timer := time.NewTimer(time.Second)
		defer timer.Stop()

		select {

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Note the template/executionId that hit it and disable that template (-et / remove from path)
2. Update nuclei to the latest release — native panics are bugs and get patched
3. Reproduce with the template standalone (nuclei -t that-template -u target -v) and report at github.com/projectdiscovery/nuclei/issues including the panic value

In template JS, wrap risky native calls in try/catch to convert ordinary failures into handled errors — this does NOT catch Go panics, which arrive as the recovered 'panic: ...' error from Execute; at the Go level, check the returned error, log executionId/template path, exclude the template, and continue the scan.

When it happens

Trigger: A code-protocol template calling a native helper that panics: nil map/index dereference in Go, assertion failure in a binding, concurrent runtime misuse. The recover() in session.go:143 is the only thing keeping the process alive.

Common situations: Bugs in a specific nuclei version's JS bindings (fixed in later releases); templates exercising newly added libs; SDK embedding that reuses one runtime across goroutines.

Related errors

• nuclei js runtime: program failed to terminate after interru
• panic occurred while executing flow: %v
• invalid TicketRequest: %w
• invalid ASRepRoastRequest: %w
• krbroast: no executionId on goja runtime

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/d2ebe5cecd922539. Report an issue: GitHub.