Registers a fuzz test. In fuzzing mode, the target is called with mutated inputs generated by the fuzzing engine. In regression mode, the target is called once per corpus entry.
Load automatic seeds (detector-contributed seeds and built-in default seeds). Set false to start from a single empty seed unless you provide your own corpus.
Per-execution timeout in milliseconds (0 = disabled)
fuzzTimeMs
number
0
Total fuzzing time limit in milliseconds (0 = unlimited)
fuzzExecs
number
0
Maximum fuzzing iterations (0 = unlimited)
replayOnly
boolean
false
When true, each loaded corpus entry is executed once with no mutation and the campaign then exits (reporting the first crash). Honors libFuzzer’s -runs=0 “replay corpus once” semantics. Distinct from fuzzExecs: 0, which means unlimited. The libfuzzer subcommand sets this automatically from -runs=0; you rarely need to set it directly.
When timeoutMs is set, it also bounds each corpus entry during regression,
optimize, and merge replay: a hung entry fails (regression) or is skipped with
a warning (optimize/merge) instead of hanging the run, and Vitest’s own test
timeout is disabled for that test since entries are bounded individually.
fuzzTimeMs bounds the whole campaign, including the calibration, mutation
stage, and crash-minimization phases that run after an interesting input or
crash: those phases stop (and minimization is skipped) once the budget is
exhausted, and batch sizes shrink as the deadline approaches. A target
execution already in flight is not interrupted - only timeoutMs bounds a
single execution. fuzzExecs counts main-loop executions only; calibration
and stage executions do not count toward it.