#7801·nuclei

OpenAPI importer sends format: binary octet-stream bodies as text/plain

Author: omlahoreCreated Sep 29, 2026Updated Sep 29, 2026

A requestBody with application/octet-stream and format: binary goes out with Content-Type: text/plain. The octet-stream branch in generator.go checks the format against "bindary", so only format: byte gets the octet-stream header:

https://github.com/projectdiscovery/nuclei/blob/54f9310945802bafddd7d3c299c133c596fd9f7e/pkg/input/formats/openapi/generator.go#L348

I parsed this spec with the openapi input format on dev (54f93109) and the POST /upload request came out with Content-Type: text/plain:

yaml
openapi: 3.0.0
info: {title: t, version: "1"}
servers: [{url: "http://example.com"}]
paths:
  /upload:
    post:
      requestBody:
        content:
          application/octet-stream: {schema: {type: string, format: binary}}
      responses:
        "200": {description: ok}

An upload endpoint that checks the content type might reject that, so it wouldn't get scanned with the body it expects.