[BUG] fatal error: fault on Windows Server 2025

[satk0]

Is there an existing issue for this?

• I have searched the existing issues.

Current Behavior

Hello,

Nuclei is crashing with fatal error: fault on Windows Server 2025 with "random" goroutine errors. The issue persists for the newest nuclei version (build from master branch), as well as for nuclei 3.4.10 and 3.4.9.

Expected Behavior

Successful scan.

Steps To Reproduce

Command:

C:\ProgramData\Scan\Nuclei\nuclei\nuclei.exe -ud "C:\ProgramData\Scan\Nuclei\templates" -l "C:\ProgramData\Scan\Nuclei\targets\5d7ed167-eb15-4ccd-8aaf-12a969c63324.txt" -no-color -j -o "C:\ProgramData\Scan\Nuclei\output\1db673e6-0644-4c70-b38d-58030b21b687.txt" -sr -exclude-templates "C:\ProgramData\Scan\Nuclei\nuclei\exclude-templates.txt" -etags "C:\ProgramData\Scan\Nuclei\nuclei\etags.txt" -v

Note: The command was run only for the one, current, host.

Relevant log output

Log fragment:

unexpected fault address 0xffffffffffffffff
fatal error: fault
[VER] [CVE-2025-32815] Sent HTTP request to https://172.30.100.10/netmri/common/SetRawCookie.tdf?name=letmein&value=%78%79%7a%0d%0a%55%73%65%72%4e%61%6d%65%3d%61%64%6d%69%6e
[signal 0xc0000005 code=0x0 addr=0xffffffffffffffff pc=0x7ff7983949fb]

goroutine 102430 gp=0xc00460d340 m=24 mp=0xc004c34008 [running]:
runtime.throw({0x7ff79ae89a8c?, 0x7ff797b63405?})
        C:/Program Files/Go/src/runtime/panic.go:1094 +0x4d fp=0xc02ad50990 sp=0xc02ad50960 pc=0x7ff797b3f5ad
runtime.sigpanic()
        C:/Program Files/Go/src/runtime/signal_windows.go:406 +0xd0 fp=0xc02ad509d8 sp=0xc02ad50990 pc=0x7ff797b20170
github.com/projectdiscovery/utils/url.URLEncodeWithEscapes({0x7320666f20657275, 0x2a}, {0x0, 0x0, 0x0?})
        C:/Users/svadmin/go/pkg/mod/github.com/projectdiscovery/utils@v0.6.1-0.20251030144701-ce5c4b44e1e6/url/rawparam.go:192 +0x13b fp=0xc02ad50ab0 sp=0xc02ad509d8 pc=0x7ff7983949fb
github.com/projectdiscovery/nuclei/v3/pkg/protocols/http.(*Request).executeRequest(0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/pkg/protocols/http/request.go:849 +0x181a fp=0xc02ad51720 sp=0xc02ad50ab0 pc=0x7ff799e40c1a
created by github.com/projectdiscovery/nuclei/v3/pkg/core.(*Engine).executeTemplateWithTargets in goroutine 102424
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/pkg/core/executors.go:99 +0x316

goroutine 1 gp=0xc0000021c0 m=nil [select]:
runtime.gopark(0xc03152f548?, 0x2?, 0x2a?, 0xd6?, 0xc03152f50c?)
        C:/Program Files/Go/src/runtime/proc.go:460 +0xce fp=0xc03152f398 sp=0xc03152f378 pc=0x7ff797b3f6ce
runtime.selectgo(0xc03152f548, 0xc03152f508, 0x6?, 0x0, 0x7ff797adb334?, 0x1)
        C:/Program Files/Go/src/runtime/select.go:351 +0x8c5 fp=0xc03152f4d8 sp=0xc03152f398 pc=0x7ff797b1d745
golang.org/x/sync/semaphore.(*Weighted).Acquire(0xc0291ed590, {0x7ff79bfecfe0, 0x7ff79ed4be20}, 0x1)
        C:/Users/svadmin/go/pkg/mod/golang.org/x/sync@v0.17.0/semaphore/semaphore.go:74 +0x333 fp=0xc03152f588 sp=0xc03152f4d8 pc=0x7ff7987386d3
github.com/projectdiscovery/utils/sync/semaphore.(*Semaphore).Acquire(...)
        C:/Users/svadmin/go/pkg/mod/github.com/projectdiscovery/utils@v0.6.1-0.20251030144701-ce5c4b44e1e6/sync/semaphore/semaphore.go:32
github.com/projectdiscovery/utils/sync.(*AdaptiveWaitGroup).AddWithContext(0xc0167eaa50, {0x7ff79bfecfe0, 0x7ff79ed4be20})
        C:/Users/svadmin/go/pkg/mod/github.com/projectdiscovery/utils@v0.6.1-0.20251030144701-ce5c4b44e1e6/sync/adaptivewaitgroup.go:71 +0x58 fp=0xc03152f5b8 sp=0xc03152f588 pc=0x7ff799129118
github.com/projectdiscovery/utils/sync.(*AdaptiveWaitGroup).Add(...)
        C:/Users/svadmin/go/pkg/mod/github.com/projectdiscovery/utils@v0.6.1-0.20251030144701-ce5c4b44e1e6/sync/adaptivewaitgroup.go:62
github.com/projectdiscovery/nuclei/v3/pkg/core.(*Engine).executeTemplateSpray(0xc001701a10, {0x7ff79bfecfe0, 0x7ff79ed4be20}, {0xc027e0a000, 0x1b6a, 0x7ff79ed1e398?}, {0x7ff79bffba70, 0xc0007cc1e0})
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/pkg/core/execute_options.go:131 +0x187 fp=0xc03152f648 sp=0xc03152f5b8 pc=0x7ff799ede787
github.com/projectdiscovery/nuclei/v3/pkg/core.(*Engine).ExecuteScanWithOpts(0xc001701a10, {0x7ff79bfecfe0, 0x7ff79ed4be20}, {0xc026f1a000, 0x21fd, 0x2400}, {0x7ff79bffba70, 0xc0007cc1e0}, 0x0)
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/pkg/core/execute_options.go:91 +0x845 fp=0xc03152f7b8 sp=0xc03152f648 pc=0x7ff799ede545
github.com/projectdiscovery/nuclei/v3/internal/runner.(*Runner).executeTemplatesInput(0xc0019b4120, 0xc0019c84d0, 0xc001701a10)
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/internal/runner/runner.go:836 +0x250 fp=0xc03152f880 sp=0xc03152f7b8 pc=0x7ff79a452b30
github.com/projectdiscovery/nuclei/v3/internal/runner.(*Runner).runStandardEnumeration(0xc0019b4120?, 0xc0019c84d0?, 0x7ff79ae8320a?, 0xc0016b8c00?)
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/internal/runner/runner.go:401 +0x36 fp=0xc03152f8b0 sp=0xc03152f880 pc=0x7ff79a44ec76
github.com/projectdiscovery/nuclei/v3/internal/runner.(*Runner).RunEnumeration(0xc0019b4120)
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/internal/runner/runner.go:723 +0x1e92 fp=0xc03152fce8 sp=0xc03152f8b0 pc=0x7ff79a451232
main.main()
        C:/Users/svadmin/Desktop/nuclei-dev/nuclei-dev/cmd/nuclei/main.go:224 +0xbe5 fp=0xc03152ff50 sp=0xc03152fce8 pc=0x7ff79a4599a5
runtime.main()
        C:/Program Files/Go/src/runtime/proc.go:285 +0x27d fp=0xc03152ffe0 sp=0xc03152ff50 pc=0x7ff797b0a9dd
runtime.goexit({})
        C:/Program Files/Go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc03152ffe8 sp=0xc03152ffe0 pc=0x7ff797b47fe1

goroutine 2 gp=0xc0000028c0 m=nil [force gc (idle)]:
runtime.gopark(0x0?, 0x0?, 0x0?, 0x0?, 0x0?)
        C:/Program Files/Go/src/runtime/proc.go:460 +0xce fp=0xc00009bfa8 sp=0xc00009bf88 pc=0x7ff797b3f6ce
runtime.goparkunlock(...)
        C:/Program Files/Go/src/runtime/proc.go:466
runtime.forcegchelper()
        C:/Program Files/Go/src/runtime/proc.go:373 +0xb8 fp=0xc00009bfe0 sp=0xc00009bfa8 pc=0x7ff797b0acf8
runtime.goexit({})
        C:/Program Files/Go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc00009bfe8 sp=0xc00009bfe0 pc=0x7ff797b47fe1
created by runtime.init.7 in goroutine 1
        C:/Program Files/Go/src/runtime/proc.go:361 +0x1a

goroutine 3 gp=0xc000002c40 m=nil [GC sweep wait]:
runtime.gopark(0x7ff79ecdf001?, 0x0?, 0x0?, 0x0?, 0x0?)
        C:/Program Files/Go/src/runtime/proc.go:460 +0xce fp=0xc00009df80 sp=0xc00009df60 pc=0x7ff797b3f6ce
runtime.goparkunlock(...)
        C:/Program Files/Go/src/runtime/proc.go:466
runtime.bgsweep(0xc0000aa000)
        C:/Program Files/Go/src/runtime/mgcsweep.go:323 +0xdf fp=0xc00009dfc8 sp=0xc00009df80 pc=0x7ff797af02ff
runtime.gcenable.gowrap1()
        C:/Program Files/Go/src/runtime/mgc.go:212 +0x25 fp=0xc00009dfe0 sp=0xc00009dfc8 pc=0x7ff797ae4245
runtime.goexit({})
        C:/Program Files/Go/src/runtime/asm_amd64.s:1693 +0x1 fp=0xc00009dfe8 sp=0xc00009dfe0 pc=0x7ff797b47fe1
created by runtime.gcenable in goroutine 1
        C:/Program Files/Go/src/runtime/mgc.go:212 +0x66

Environment

- OS: Microsoft Windows Server Version 24H2 (OS Build 26100.6905)
- Nuclei: 3.4.10 (master branch)
- Go: go1.25.3 windows/amd64
- CPU: Intel(R) Xeon(R) Gold 5415+ (16 CPUS), ~2.9GHz
- RAM: 32 GB

Anything else?

I attach the full error log file:
error.txt

Btw, thank you for the amazing project. However it is really hard to use it for Windows (at least for the company I work in 😅).

It will be great if I get any tip on why is it failing all the time, thanks in advance.

[Mzack9999]

This is a very weird crash, thanks for reporting it @satk0 !

I'm trying to reproduce it on a windows box but unable to get the crash. Would it be possible to provide more info on the target system (another windows box? Linux?).
Do you get the crash even removing the exclude templates and etags CLI options?

[satk0]

Thanks a lot @Mzack9999 for such a fast and detailed reply ;)

I will ask about it, as well as trying to remove those flags on Monday and will let you know.

BTW, Do you think that this crash could also be caused by some templates? And excluding them would help to resolve it?

[satk0]

Hi, following up to my prev reply:

Would it be possible to provide more info on the target system (another windows box? Linux?).

What info do you want? System info? How can I get it?

Do you get the crash even removing the exclude templates and etags CLI options?

Yes

[satk0]

SHORT NOTE

Adding sysvar:

setx /M GODEBUG asyncpreemptoff=1

And changing Nuclei command to:

C:\ProgramData\Scanner\Nuclei\nuclei\nuclei.exe -ud "C:\ProgramData\Scanner\Nuclei\templates" -l "C:\ProgramData\Scanner\Nuclei\targets\5d7ed167-eb15-4ccd-8aaf-12a969c63324.txt" -no-color -j -o "C:\ProgramData\Scanner\Nuclei\output\5d7ed167-eb15-4ccd-8aaf-12a969c63324.txt" -exclude-templates "C:\ProgramData\Scanner\Nuclei\nuclei\exclude-templates.txt" -etags "C:\ProgramData\Scanner\Nuclei\nuclei\etags.txt" -v -dr -c 2 -rl 15 -timeout 8 -system-resolvers -disable-clustering -nh -ni

fixes the problem.