projectdiscovery/nuclei · error

proxy denied by network policy

Error message

proxy denied by network policy

What it means

Sentinel error from the goexec helper. When options.proxy is set, proxyAllowed() parses the proxy URI and checks its hostname against protocolstate.IsHostAllowed (adapter_goexec.go:44-46, 387-393). A policy-disallowed proxy hostname stops the run with ErrProxyDenied. Note the lenient edge: a proxy URI that fails to parse or has an empty hostname is allowed through, so this error specifically means the proxy host was resolved and denied.

Source

Thrown at pkg/js/libs/goexec/errors.go:18

package goexec

import "errors"

var (
	ErrMissingAuth             = errors.New("goexec auth is required")
	ErrMissingUsername         = errors.New("goexec username is required for this auth mode")
	ErrMultipleCredentialModes = errors.New("goexec auth selects multiple primary credential modes")
	ErrMissingTarget           = errors.New("goexec target is required")
	ErrMissingCommand          = errors.New("goexec command is required")
	ErrMissingExecutable       = errors.New("goexec executable is required")
	ErrUnsupportedModule       = errors.New("unsupported goexec module")
	ErrUnsupportedMethod       = errors.New("unsupported goexec method")
	ErrUnsupportedOutputMethod = errors.New("unsupported goexec output method")
	ErrNetworkPolicyDenied     = errors.New("target denied by network policy")
	ErrInvalidMethodArguments  = errors.New("invalid goexec method arguments")
	ErrDomainControllerDenied  = errors.New("domain controller denied by network policy")
	ErrProxyDenied             = errors.New("proxy denied by network policy")
	ErrEndpointDenied          = errors.New("endpoint denied by network policy")
)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Allow the proxy host/IP in the network policy
2. Remove the proxy option and connect directly if policy permits the target
3. Verify with protocolstate.IsHostAllowed on the parsed proxy hostname before the run

func proxyCheck(proxyURI string) error {
    u, err := url.Parse(proxyURI)
    if err != nil || u.Hostname() == "" { return nil } // adapter allows these
    if !protocolstate.IsHostAllowed(executionID, u.Hostname()) {
        return errors.New("proxy host blocked by network policy")
    }
    return nil
}

func isProxyDenied(err error) bool { return errors.Is(err, goexec.ErrProxyDenied) }

When it happens

Trigger: goexec request with options: {proxy: 'http://10.10.10.1:8080'} while the policy excludes 10.10.10.1; any proxy whose hostname resolves into a denied CIDR.

Common situations: Internal pivot proxies on subnets the policy does not cover; corporate proxy IPs added after the policy was written.

Related errors

• target denied by network policy
• domain controller denied by network policy
• unsupported goexec method
• unsupported goexec output method
• invalid goexec method arguments

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/765b4fe50d339e88. Report an issue: GitHub.