projectdiscovery/nuclei · error

response read size must be non-negative

Error message

response read size must be non-negative

What it means

The first non-annotation line of a raw request is split on single spaces and must yield at least three fields (method, target, protocol). Shorter lines - missing HTTP version or missing method - are rejected as malformed before any URL parsing or network work happens.

Source

Thrown at lib/config.go:169

			return errors.New("probe concurrency must be at least 1")
		}
		e.opts.TemplateThreads = opts.TemplateConcurrency
		e.opts.BulkSize = opts.HostConcurrency
		e.opts.HeadlessBulkSize = opts.HeadlessHostConcurrency
		e.opts.HeadlessTemplateThreads = opts.HeadlessTemplateConcurrency
		e.opts.JsConcurrency = opts.JavascriptTemplateConcurrency
		e.opts.PayloadConcurrency = opts.TemplatePayloadConcurrency
		e.opts.ProbeConcurrency = opts.ProbeConcurrency
		return nil
	}
}

// WithResponseReadSize sets the maximum size of response to read in bytes.
// A value of 0 means no limit. Recommended values: 1MB (1048576) to 10MB (10485760).
func WithResponseReadSize(responseReadSize int) NucleiSDKOptions {
	return func(e *NucleiEngine) error {
		if responseReadSize < 0 {
			return errors.New("response read size must be non-negative")
		}
		e.opts.ResponseReadSize = responseReadSize
		return nil
	}
}

// WithGlobalRateLimit sets global rate (i.e all hosts combined) limit options
// Deprecated: will be removed in favour of WithGlobalRateLimitCtx in next release
func WithGlobalRateLimit(maxTokens int, duration time.Duration) NucleiSDKOptions {
	return WithGlobalRateLimitCtx(context.Background(), maxTokens, duration)
}

// WithGlobalRateLimitCtx allows setting a global rate limit for the entire engine
func WithGlobalRateLimitCtx(ctx context.Context, maxTokens int, duration time.Duration) NucleiSDKOptions {
	return func(e *NucleiEngine) error {
		e.opts.RateLimit = maxTokens
		e.opts.RateLimitDuration = duration
		e.rateLimiter = utils.GetRateLimiter(ctx, e.opts.RateLimit, e.opts.RateLimitDuration)

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Write the full request line: GET /path HTTP/1.1
2. Keep annotations on their own @-prefixed lines above it
3. Avoid stray spacing that changes the field count
4. Run nuclei -validate on the template

Example fix

# before
GET {{BaseURL}}
# after
GET {{BaseURL}} HTTP/1.1

import (
    "regexp"
    "strings"
)

var requestLineRe = regexp.MustCompile(`^\S+ \S+ \S+`)

func validRequestLine(line string) bool {
    return requestLineRe.MatchString(strings.TrimSpace(line))
}

When it happens

Trigger: A request line like 'GET /path' (no HTTP/1.1) or '/path HTTP/1.1' (no method); lines mangled by formatting so fields merge or vanish.

Common situations: Hand-edited templates; converting curl commands and dropping the version token; OCR or copy artifacts.

Related errors

• no new line found at the end of host header
• probe concurrency must be at least 1
• empty filename
• no host header found
• cannot use unsafe with http fuzzing templates

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/3919763ff6632624. Report an issue: GitHub.