Skip to content

fuzz() API

function fuzz(
name: string,
target: (data: Buffer) => void | Promise<void>,
options?: FuzzOptions,
): void

Registers a fuzz test. In fuzzing mode, the target is called with mutated inputs generated by the fuzzing engine. In regression mode, the target is called once per corpus entry.

Parameter Type Description
name string Test name. Used for corpus directory naming and -test filtering.
target (data: Buffer) => void | Promise<void> Function to fuzz. Receives raw bytes as a Buffer. Async targets are awaited.
options FuzzOptions Optional per-test configuration. Overrides plugin-level defaults.
Modifier Description
fuzz.skip(name, target, options?) Skip this fuzz test
fuzz.only(name, target, options?) Run only this fuzz test
fuzz.todo(name) Mark as todo (no target function needed)

All fields are optional. Unset fields inherit from plugin-level fuzz configuration, which in turn falls back to defaults.

Field Type Default Description
maxLen number 4096 Maximum input length in bytes
seed number random RNG seed for reproducible fuzzing
autoSeed boolean true Load automatic seeds (detector-contributed seeds and built-in default seeds). Set false to start from a single empty seed unless you provide your own corpus.
Field Type Default Description
timeoutMs number 0 Per-execution timeout in milliseconds (0 = disabled)
fuzzTimeMs number 0 Total fuzzing time limit in milliseconds (0 = unlimited)
fuzzExecs number 0 Maximum fuzzing iterations (0 = unlimited)
replayOnly boolean false When true, each loaded corpus entry is executed once with no mutation and the campaign then exits (reporting the first crash). Honors libFuzzer’s -runs=0 “replay corpus once” semantics. Distinct from fuzzExecs: 0, which means unlimited. The libfuzzer subcommand sets this automatically from -runs=0; you rarely need to set it directly.

When timeoutMs is set, it also bounds each corpus entry during regression, optimize, and merge replay: a hung entry fails (regression) or is skipped with a warning (optimize/merge) instead of hanging the run, and Vitest’s own test timeout is disabled for that test since entries are bounded individually.

fuzzTimeMs bounds the whole campaign, including the calibration, mutation stage, and crash-minimization phases that run after an interesting input or crash: those phases stop (and minimization is skipped) once the budget is exhausted, and batch sizes shrink as the deadline approaches. A target execution already in flight is not interrupted - only timeoutMs bounds a single execution. fuzzExecs counts main-loop executions only; calibration and stage executions do not count toward it.

Field Type Default Description
stopOnCrash boolean | "auto" "auto" true: stop on first crash. false: continue fuzzing. "auto": continue in vitest/programmatic mode and in CLI with -fork; stop in CLI without -fork.
maxCrashes number 1000 Maximum crashes to collect before stopping (0 = unlimited). Only effective when stopOnCrash is false.
Field Type Default Description
grimoire boolean auto Grimoire structure-aware mutations. Auto-enabled for UTF-8 corpus.
unicode boolean auto Unicode-aware character-level mutations. Auto-enabled for UTF-8 corpus.
redqueen boolean auto REDQUEEN transform-aware mutations. Auto-enabled for binary corpus.
jsonMutations boolean auto JSON-aware structure-preserving byte mutations. Auto-enabled when the majority of UTF-8 corpus entries look like JSON.
Field Type Default Description
minimizeBudget number 10000 Maximum re-executions during crash minimization
minimizeTimeLimitMs number 5000 Time limit for minimization in milliseconds (0 = disabled)
Field Type Default Description
banner boolean true Show one-line startup banner
quiet boolean false Suppress banner, status lines, and summary. Crash output always prints.
Field Type Default Description
detectors DetectorsConfig tier 1 enabled Object mapping detector names to boolean or options. See Detectors Reference.