What causes "template threads must be at least 1" in projectdiscovery/nuclei?

Percent-encode unsafe characters (space as %20) in the URL

template threads must be at least 1

Error message

template threads must be at least 1

What it means

parseSMBURL hands the smb:// URL to net/url.Parse; syntax errors - control characters, invalid percent-escapes, malformed IPv6 brackets - surface wrapped as 'parse smb url'. The URL must satisfy Go's URL grammar before the SMB-specific checks run.

Source

Thrown at lib/config.go:133

}

// Concurrency options
type Concurrency struct {
	TemplateConcurrency           int // number of templates to run concurrently (per host in host-spray mode)
	HostConcurrency               int // number of hosts to scan concurrently  (per template in template-spray mode)
	HeadlessHostConcurrency       int // number of hosts to scan concurrently for headless templates  (per template in template-spray mode)
	HeadlessTemplateConcurrency   int // number of templates to run concurrently for headless templates (per host in host-spray mode)
	JavascriptTemplateConcurrency int // number of templates to run concurrently for javascript templates (per host in host-spray mode)
	TemplatePayloadConcurrency    int // max concurrent payloads to run for a template (a good default is 25)
	ProbeConcurrency              int // max concurrent http probes to run (a good default is 50)
}

// WithConcurrency sets concurrency options
func WithConcurrency(opts Concurrency) NucleiSDKOptions {
	return func(e *NucleiEngine) error {
		// minimum required is 1
		if opts.TemplateConcurrency <= 0 {
			return errors.New("template threads must be at least 1")
		}
		if opts.HostConcurrency <= 0 {
			return errors.New("host concurrency must be at least 1")
		}
		if opts.HeadlessHostConcurrency <= 0 {
			return errors.New("headless host concurrency must be at least 1")
		}
		if opts.HeadlessTemplateConcurrency <= 0 {
			return errors.New("headless template threads must be at least 1")
		}
		if opts.JavascriptTemplateConcurrency <= 0 {
			return errors.New("js must be at least 1")
		}
		if opts.TemplatePayloadConcurrency <= 0 {
			return errors.New("payload concurrency must be at least 1")
		}
		if opts.ProbeConcurrency <= 0 {
			return errors.New("probe concurrency must be at least 1")

View on GitHub (pinned to 265b3a3dec)

Solutions

Percent-encode unsafe characters (space as %20) in the URL
Quote the full path in the shell to prevent mangling
Pre-validate with url.Parse when generating URLs programmatically

Example fix

# before
smb://host/share/my file.txt
# after
smb://host/share/my%20file.txt

Defensive patterns

Strategy: validation

Validate before calling

import (
    "net/url"
    "strings"
)

func validSMBURL(raw string) bool {
    if !strings.HasPrefix(strings.ToLower(raw), "smb://") {
        return true // UNC form; different checks apply
    }
    _, err := url.Parse(raw)
    return err == nil
}

Prevention

Percent-encode spaces and special bytes in URLs
Shell-quote SMB URLs to prevent mangling
Build URLs with net/url primitives, not string concatenation

When it happens

Trigger: smb://host/share/a b.txt (raw space), smb://host/%zz (bad escape sequence), or unencoded control characters anywhere in the URL.

Common situations: Unquoted paths with spaces on the command line; hand-assembled URLs missing percent-encoding; clipboard artifacts.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/480d2b76ca57d1d7. Report an issue: GitHub.