projectdiscovery/nuclei · error

'%s' is not a valid severity

Error message

'%s' is not a valid severity

What it means

Returned by setSeverity in nuclei' severity model when toSeverity cannot map a string to a known severity level. Severities is parsed from both CLI flags (-severity / -s) and template JSON via UnmarshalJSON/Set, and every value must be one of the supported levels (info, low, medium, high, critical, unknown); anything else aborts parsing with the offending value echoed back.

Source

Thrown at pkg/model/types/severity/severities.go:90

	var stringSeverities = make([]string, 0, len(severities))
	for _, severity := range severities {
		stringSeverities = append(stringSeverities, severity.String())
	}
	return strings.Join(stringSeverities, ", ")
}

func (severities Severities) MarshalJSON() ([]byte, error) {
	var stringSeverities = make([]string, 0, len(severities))
	for _, severity := range severities {
		stringSeverities = append(stringSeverities, severity.String())
	}
	return json.Marshal(stringSeverities)
}

func setSeverity(severities *Severities, value string) error {
	computedSeverity, err := toSeverity(value)
	if err != nil {
		return fmt.Errorf("'%s' is not a valid severity", value)
	}

	// TODO change the Severities type to map[Severity]interface{}, where the values are struct{}{}, to "simulates" a "set" data structure
	*severities = append(*severities, computedSeverity)
	return nil
}

View on GitHub (pinned to 265b3a3dec)

Solutions

1. Fix the value to one of: info, low, medium, high, critical, unknown (write severity values lowercase in templates)
2. Validate templates with nuclei's template validation (-tl / template-validate) before running them
3. When passing -severity on the CLI, double-check each comma-separated element against the accepted set

Example fix

# before (template)
info:
  severity: informational

# after
info:
  severity: info

package main

import "strings"

var validSeverities = map[string]bool{"info": true, "low": true, "medium": true, "high": true, "critical": true, "unknown": true}

func severityValid(s string) bool { return validSeverities[strings.ToLower(strings.TrimSpace(s))] }

func severityValid(s string) bool { return validSeverities[strings.ToLower(strings.TrimSpace(s))] }

When it happens

Trigger: A template with info.severity: 'informational' or 'moderate' instead of the accepted keywords; a typo like 'critcial' or 'meduim'; CLI usage like -severity high,criticals; extra whitespace/case variants that the parser does not normalize.

Common situations: Hand-edited or third-party templates with non-standard severity labels; older templates predating severity normalization; CI pipelines passing a custom severity list via flags where one element is misspelled.

Related errors

• Invalid severity: %s
• validation failed for these fields
• Invalid extractor type: %s
• Invalid matcher type: %s
• Invalid DNS request type: %s

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/089ae0da7be81da1. Report an issue: GitHub.