fuzz() API

fuzz()

function fuzz(
  name: string,
  target: (data: Buffer) => void | Promise<void>,
  options?: FuzzOptions,
): void

Registers a fuzz test. In fuzzing mode, the target is called with mutated inputs generated by the fuzzing engine. In regression mode, the target is called once per corpus entry.

Parameters

Parameter	Type	Description
`name`	`string`	Test name. Used for corpus directory naming and `-test` filtering.
`target`	`(data: Buffer) => void \| Promise<void>`	Function to fuzz. Receives raw bytes as a `Buffer`. Async targets are awaited.
`options`	`FuzzOptions`	Optional per-test configuration. Overrides plugin-level defaults.

Modifiers

Modifier	Description
`fuzz.skip(name, target, options?)`	Skip this fuzz test
`fuzz.only(name, target, options?)`	Run only this fuzz test
`fuzz.todo(name)`	Mark as todo (no target function needed)

FuzzOptions

All fields are optional. Unset fields inherit from plugin-level fuzz configuration, which in turn falls back to defaults.

Input Control

Field	Type	Default	Description
`maxLen`	`number`	`4096`	Maximum input length in bytes
`seed`	`number`	random	RNG seed for reproducible fuzzing

Execution Limits

Field	Type	Default	Description
`timeoutMs`	`number`	`0`	Per-execution timeout in milliseconds (0 = disabled)
`fuzzTimeMs`	`number`	`0`	Total fuzzing time limit in milliseconds (0 = unlimited)
`fuzzExecs`	`number`	`0`	Maximum fuzzing iterations (0 = unlimited)

Crash Handling

Field	Type	Default	Description
`stopOnCrash`	`boolean \| "auto"`	`"auto"`	`true`: stop on first crash. `false`: continue fuzzing. `"auto"`: stop in CLI mode, continue in programmatic mode.
`maxCrashes`	`number`	`0`	Maximum crashes to collect before stopping (0 = unlimited)

Mutation Strategies

Field	Type	Default	Description
`grimoire`	`boolean`	auto	Grimoire structure-aware mutations. Auto-enabled for UTF-8 corpus.
`unicode`	`boolean`	auto	Unicode-aware character-level mutations. Auto-enabled for UTF-8 corpus.
`redqueen`	`boolean`	auto	REDQUEEN transform-aware mutations. Auto-enabled for binary corpus.

Crash Minimization

Field	Type	Default	Description
`minimizeBudget`	`number`	`10000`	Maximum re-executions during crash minimization
`minimizeTimeLimitMs`	`number`	`5000`	Time limit for minimization in milliseconds (0 = disabled)

Output

Field	Type	Default	Description
`banner`	`boolean`	`true`	Show one-line startup banner
`quiet`	`boolean`	`false`	Suppress banner, status lines, and summary. Crash output always prints.

Detectors

Field	Type	Default	Description
`detectors`	`DetectorsConfig`	tier 1 enabled	Object mapping detector names to `boolean` or options. See Detectors Reference.