What causes "validation failed for these fields" in projectdiscovery/nuclei?

Add at least one non-empty entry to the inline payload list

validation failed for these fields

Error message

validation failed for these fields

What it means

Thrown by generators.ValidatePayloads when a template declares a payload as an inline list but types.ToStringSlice yields zero elements. Nuclei iterates payload values to build requests, so an empty payload cannot generate any work and template validation aborts. It fires at compile/validate time, before any network activity.

Source

Thrown at internal/runner/options.go:153

		}
	}

	if options.OfflineHTTP {
		options.DisableHTTPProbe = true
	}
}

// validateOptions validates the configuration options passed
func ValidateOptions(options *types.Options) error {
	if err := validateOptions.Struct(options); err != nil {
		if _, ok := err.(*validator.InvalidValidationError); ok {
			return err
		}
		errs := []string{}
		for _, err := range err.(validator.ValidationErrors) {
			errs = append(errs, err.Namespace()+": "+err.Tag())
		}
		return errors.Wrap(errors.New(strings.Join(errs, ", ")), "validation failed for these fields")
	}
	if options.Verbose && options.Silent {
		return errors.New("both verbose and silent mode specified")
	}

	if (options.HeadlessOptionalArguments != nil || options.ShowBrowser || options.UseInstalledChrome) && !options.Headless {
		return errors.New("headless mode (-headless) is required if -ho, -sb, -sc or -lha are set")
	}

	if options.FollowHostRedirects && options.FollowRedirects {
		return errors.New("both follow host redirects and follow redirects specified")
	}
	if options.ShouldFollowHTTPRedirects() && options.DisableRedirects {
		return errors.New("both follow redirects and disable redirects specified")
	}
	// loading the proxy server list from file or cli and test the connectivity
	if err := loadProxyServers(options); err != nil {
		return err

View on GitHub (pinned to 265b3a3dec)

Solutions

Add at least one non-empty entry to the inline payload list
If the payload is meant to be a wordlist, reference a file instead (payloads: {name: [wordlist.txt]})
Remove null or empty entries that ToStringSlice silently drops
Run nuclei -validate -t template.yaml after the fix to confirm

Example fix

# before
payloads:
  username: []
# after
payloads:
  username:
    - admin
    - root

Defensive patterns

Strategy: validation

Validate before calling

import (
    "fmt"
    "strings"
)

// Check inline template payloads before handing the template to nuclei.
func payloadsNonEmpty(payloads map[string]interface{}) error {
    for name, v := range payloads {
        if list, ok := v.([]interface{}); ok {
            usable := 0
            for _, e := range list {
                if s, ok := e.(string); ok && strings.TrimSpace(s) != "" {
                    usable++
                }
            }
            if usable == 0 {
                return fmt.Errorf("payload %s is an empty list", name)
            }
        }
    }
    return nil
}

Prevention

Run nuclei -validate on every template change
Never ship payloads: {name: []} placeholders
Prefer file-based wordlists for real data

When it happens

Trigger: A template payload defined as an empty YAML list (payloads: {name: []}), or a list whose entries are all null (~) which ToStringSlice drops. Surfaces when running nuclei -validate or when loading the template for a scan.

Common situations: Template authoring with a placeholder payload never filled in; converting a file-based wordlist to inline form and leaving it empty; CI template-validation pipelines failing on a new template.

Related errors

AI-assisted analysis of projectdiscovery/nuclei@265b3a3dec (2026-08-15). Data as JSON: /api/errors/a77287b603672d93. Report an issue: GitHub.