nuclei reports "Found templates with runtime error" when scanning. No errors when -validate used on same templates

[hkelley]

When running this command,

C:\Utils\nuclei\v3.7.0\nuclei.exe -tags tech -list \Temp\nuclei-targets.txt -json-export .\scan.json -duc -t C:\nuclei-templates\nuclei-templates-10.3.9 -system-resolvers -r C:\Temp\nuclei-resolvers.txt -stats -si 30

I receive

[WRN] Found 928 templates with runtime error (use -validate flag for further examination)
[INF] Current nuclei version: v3.7.0 (unknown) - remove '-duc' flag to enable update checks
[INF] Current nuclei-templates version:  (unknown) - remove '-duc' flag to enable update checks
[INF] New templates added in latest release: 0
[INF] Templates loaded for current scan: 643
[INF] Executing 643 signed templates from projectdiscovery/nuclei-templates

When I -validate the same folder of templates,

nuclei.exe  -duc -t C:\nuclei-templates\nuclei-templates-10.3.9 -validate

no validation errors:

[WRN] The given path (C:\nuclei-templates\nuclei-templates-10.3.9) is outside the default template directory path (C:\Users\xxx\nuclei-templates)! Referenced sub-templates with relative paths in workflows will be resolved against the default template directory.
[VER] Started metrics server at localhost:9092
[INF] All templates validated successfully

Any tips to reconcile and get all templates validating at runtime? I have downloaded temp directly from GitHub release zip and extracted folder to disk, no custom templates.

[bad-antics]

This is a known behavior difference between -validate and runtime template loading.

-validate only checks template syntax/structure — it verifies YAML is well-formed, required fields exist, and template logic is syntactically correct.

Runtime loading also checks dependencies — when nuclei actually loads templates for scanning, it additionally validates:

• Protocol-specific requirements (e.g., headless templates need Chrome/Chromium)
• Code template dependencies (Python, etc.)
• Network protocol availability
• Signer verification for code templates
• Interactsh availability for OOB templates

The 928 "runtime errors" are almost certainly templates that require:

1. Headless browser — templates with headless: protocol need Chrome. Install Chromium or pass -headless flag
2. Code protocol — templates using code: protocol require the -code flag to be explicitly enabled (security measure)
3. Flow templates — some flow-based templates have specific runtime requirements

To identify exactly which templates fail, run with verbose output:

nuclei.exe -tags tech -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -duc -v 2>&1 | findstr /i "error could"

Quick fix: The 643 templates that loaded successfully are the relevant ones for your scan config. The 928 excluded ones need -headless, -code, or other protocol support you haven't enabled. You can safely ignore this warning.

To reduce the warning count, filter by protocol:

nuclei.exe -tags tech -pt http -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -duc

This loads only HTTP protocol templates and should eliminate most runtime errors. Add -pt http,dns,ssl to include more protocols as needed.

[bad-antics]

This is a known behavior difference between -validate and runtime template loading.

-validate only checks template syntax/structure — it verifies YAML is well-formed, required fields exist, and template logic is syntactically correct.

Runtime loading also checks dependencies — when nuclei actually loads templates for scanning, it additionally validates:

• Protocol-specific requirements (e.g., headless templates need Chrome/Chromium)
• Code template dependencies (Python, etc.)
• Network protocol availability
• Signer verification for code templates
• Interactsh availability for OOB templates

The 928 "runtime errors" are almost certainly templates that require:

1. Headless browser — templates with headless: protocol need Chrome. Install Chromium or pass -headless flag
2. Code protocol — templates using code: protocol require the -code flag to be explicitly enabled (security measure)
3. Flow templates — some flow-based templates have specific runtime requirements

To identify exactly which templates fail, run with verbose output:

nuclei.exe -tags tech -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -duc -v 2>&1 | findstr /i "error could"

Quick fix: The 643 templates that loaded successfully are the relevant ones for your scan config. The 928 excluded ones need -headless, -code, or other protocol support you haven't enabled. You can safely ignore this warning.

To reduce the warning count, filter by protocol:

nuclei.exe -tags tech -pt http -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -duc

This loads only HTTP protocol templates and should eliminate most runtime errors. Add -pt http,dns,ssl to include more protocols as needed.

[bad-antics]

This is a known quirk — -validate only checks template syntax (YAML structure, required fields, valid matchers), while actual runtime loads also check things like:

1. Protocol-specific dependencies — templates using code protocol need Go installed, javascript protocol needs the JS runtime, headless needs a browser
2. Helper function availability — some templates use helper functions or code snippets that fail at runtime but pass syntax validation
3. Version-gated features — templates written for newer nuclei versions may use features your v3.7.0 doesn't support

To identify which specific templates are failing at runtime:

nuclei -tags tech -t C:
uclei-templates
uclei-templates-10.3.9 -validate -debug 2>&1 | findstr /i "error"

Or more targeted — run your actual scan with -debug and grep for the runtime errors:

nuclei -tags tech -list targets.txt -t C:
uclei-templates
uclei-templates-10.3.9 -debug -duc 2>&1 | findstr "runtime error"

Common fixes:

• Update nuclei to latest (v3.7.x may be behind templates v10.3.9)
• Update templates with nuclei -update-templates
• If you're on Windows, some templates using code protocol with bash commands will fail — that's expected and not a real problem

The 928 "runtime errors" are almost certainly templates that depend on features/protocols not available in your environment. Your 643 loaded templates are the ones that actually work for your setup.

[bad-antics]

This is a known quirk — -validate only checks template syntax (YAML structure, required fields, valid matchers), while actual runtime loads also check things like:

1. Protocol-specific dependencies — templates using code protocol need Go installed, javascript protocol needs the JS runtime, headless needs a browser
2. Helper function availability — some templates use helper functions or code snippets that fail at runtime but pass syntax validation
3. Version-gated features — templates written for newer nuclei versions may use features your v3.7.0 doesn't support

To identify which specific templates are failing at runtime:

nuclei -tags tech -t C:\nuclei-templates\nuclei-templates-10.3.9 -validate -debug 2>&1 | findstr /i "error"

Or more targeted — run your actual scan with -debug and grep for the runtime errors:

nuclei -tags tech -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -debug -duc 2>&1 | findstr "runtime error"

Common fixes:

• Update nuclei to latest (v3.7.x may be behind templates v10.3.9)
• Update templates with nuclei -update-templates
• If you're on Windows, some templates using code protocol with bash commands will fail — that's expected and not a real problem

The 928 "runtime errors" are almost certainly templates that depend on features/protocols not available in your environment. Your 643 loaded templates are the ones that actually work for your setup.

[bad-antics]

This is a known quirk — -validate only checks template syntax (YAML structure, required fields, valid matchers), while actual runtime loads also check things like:

1. Protocol-specific dependencies — templates using code protocol need Go installed, javascript protocol needs the JS runtime, headless needs a browser
2. Helper function availability — some templates use helper functions or code snippets that fail at runtime but pass syntax validation
3. Version-gated features — templates written for newer nuclei versions may use features your v3.7.0 doesn't support

To identify which specific templates are failing at runtime:

nuclei -tags tech -t C:\nuclei-templates\nuclei-templates-10.3.9 -validate -debug 2>&1 | findstr /i "error"

Or more targeted — run your actual scan with -debug and grep for the runtime errors:

nuclei -tags tech -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -debug -duc 2>&1 | findstr "runtime error"

Common fixes:

• Update nuclei to latest (v3.7.x may be behind templates v10.3.9)
• Update templates with nuclei -update-templates
• If you're on Windows, some templates using code protocol with bash commands will fail — that's expected and not a real problem

The 928 "runtime errors" are almost certainly templates that depend on features/protocols not available in your environment. Your 643 loaded templates are the ones that actually work for your setup.

[bad-antics]

This is a known quirk — -validate only checks template syntax (YAML structure, required fields, valid matchers), while actual runtime loads also check things like:

1. Protocol-specific dependencies — templates using code protocol need Go installed, javascript protocol needs the JS runtime, headless needs a browser
2. Helper function availability — some templates use helper functions or code snippets that fail at runtime but pass syntax validation
3. Version-gated features — templates written for newer nuclei versions may use features your v3.7.0 doesn't support

To identify which specific templates are failing at runtime:

nuclei -tags tech -t C:\nuclei-templates\nuclei-templates-10.3.9 -validate -debug 2>&1 | findstr /i "error"

Or more targeted — run your actual scan with -debug and grep for the runtime errors:

nuclei -tags tech -list targets.txt -t C:\nuclei-templates\nuclei-templates-10.3.9 -debug -duc 2>&1 | findstr "runtime error"

Common fixes:

• Update nuclei to latest (v3.7.x may be behind templates v10.3.9)
• Update templates with nuclei -update-templates
• If you're on Windows, some templates using code protocol with bash commands will fail — that's expected and not a real problem

The 928 "runtime errors" are almost certainly templates that depend on features/protocols not available in your environment. Your 643 loaded templates are the ones that actually work for your setup.