mirror of
https://github.com/projectdiscovery/nuclei.git
synced 2026-11-07 17:43:04 -10:00
Ice3manandClaude Opus 5.5
2954b81c85
Templates that send multi-MB bodies (e.g. CVE-2026-109618 sends 1, 8 and 20 MB) kept 8-10 copies of each body alive per request. With 25 hosts in flight this reached ~10 GB RSS and OOM-killed scan VMs. - add pkg/utils/httpbody: a zero-copy request body that rewinds on EOF; GetBody hands out new cursors over the same slice instead of cloning - build raw, model and fuzzed request bodies with httpbody instead of retryablehttp's ReusableReadCloser, which tees every read into a second growing buffer and clones on each GetBody - dump requests with http.Request.Write into a capped writer instead of retryablehttp Dump/httputil.DumpRequestOut; output is unchanged for bodies under the cap - keep only the first 32 KiB of a body in request dumps (new -rqss/-request-size-save flag, 0 keeps all) and leave bodies over 4 KiB out of curl commands - build the project cache key only when a project file is used, hashing the body when the dump is truncated - replay sends the full body when the dump was truncated - slice the raw request body from the request instead of reading it out - pass replacer values to fasttemplate as []byte so writes don't copy them Co-Authored-By: Claude Opus 5.5 <[email protected]>