loopback protocol causes nil pointer dereference panic in loopback.go:50

[Xpos587]

Integrity requirements

• I have read all the comments in the issue template and ensured that this issue meet the requirements.
• I confirm that I have read the documentation, understand the meaning of all the configuration items I wrote, and did not pile up seemingly useful options or default values.
• I provided the complete config and logs, rather than just providing the truncated parts based on my own judgment.
• I searched issues and did not find any similar issues.
• The problem can be successfully reproduced in the latest Release

Description

Version: Xray-core 26.2.6 (12ee51e)

When using the loopback outbound protocol to route traffic back to the router for additional processing (multi-tier routing), Xray crashes with nil pointer dereference at proxy/loopback/loopback.go:50.

Stack trace:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0xe95938]

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process.func1()
    github.com/xtls/xray-core/proxy/loopback/loopback.go:50 +0x198

Expected behavior: The loopback protocol should route traffic from an outbound back to a specified inbound tag, allowing for multi-tier routing with additional processing (e.g., geo-based selection of middle proxy).

Actual behavior: Xray crashes immediately when traffic tries to pass through the loopback outbound.

Root cause: Missing nil check for l.config at line 50:

inbound.Tag = l.config.InboundTag  // l.config is nil!

The config field is nil even though the configuration JSON correctly specifies settings.inboundTag.

Reproduction Method

1. Configure a loopback outbound with settings.inboundTag pointing to an existing inbound
2. Configure a VMESS/VLESS outbound with proxySettings.tag pointing to the loopback outbound
3. Configure routing rules to send traffic through the chain
4. Start Xray-core
5. Send any HTTP request through the proxy

Xray will crash when the outbound tries to use the loopback via proxySettings.

Client config

Details

{
  "log": {
    "loglevel": "debug",
    "dnsLog": true
  },
  "inbounds": [
    {
      "tag": "proxy-in",
      "port": 10808,
      "protocol": "socks",
      "settings": {
        "auth": "noauth",
        "udp": true
      }
    },
    {
      "tag": "middle-selector-in",
      "port": 10999,
      "protocol": "dokodemo-door",
      "settings": {
        "network": "tcp,udp",
        "followRedirect": true
      },
      "sniffing": {
        "enabled": true,
        "destOverride": ["http", "tls", "quic"],
        "routeOnly": true
      }
    }
  ],
  "outbounds": [
    {
      "tag": "direct-out",
      "protocol": "freedom"
    },
    {
      "tag": "loopback-to-middle",
      "protocol": "loopback",
      "settings": {
        "inboundTag": "middle-selector-in"
      }
    },
    {
      "tag": "test-proxy",
      "protocol": "vmess",
      "proxySettings": {
        "tag": "loopback-to-middle"
      },
      "settings": {
        "vnext": [{
          "address": "example.com",
          "port": 443,
          "users": [{
            "id": "00000000-0000-0000-0000-000000000000",
            "alterId": 0,
            "security": "auto"
          }]
        }]
      },
      "streamSettings": {
        "network": "tcp",
        "security": "none"
      }
    }
  ],
  "routing": {
    "domainStrategy": "AsIs",
    "rules": [
      {
        "inboundTag": ["middle-selector-in"],
        "outboundTag": "direct-out"
      },
      {
        "inboundTag": ["proxy-in"],
        "outboundTag": "test-proxy"
      }
    ]
  }
}

Server config

N/A (this is a client-side bug, no server config required)

Client log

Details

2026/02/20 20:45:18.489911 [Warning] common/errors: The feature VLESS (with no Flow, etc.) is deprecated, not recommended for using and might be removed. Please migrate to VLESS with Flow & Seed as soon as possible.
2026/02/20 20:45:18.668059 [Warning] core: Xray 26.2.6 started
panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x50 pc=0xe95938]
goroutine 82 [running]:

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process.func1()

github.com/xtls/xray-core/proxy/loopback/loopback.go:50 +0x198

github.com/xtls/xray-core/common/retry.(*retryer).On(0xc000807d18, 0xc000807d50)

github.com/xtls/xray-core/common/retry/retry.go:27 +0xc3

github.com/xtls/xray-core/proxy/loopback.(*Loopback).Process(0xc00047c810, {0x1a7d1e0, 0xc002956390}, 0xc00167aac0, {0x159eae0?, 0xc00251c840?})

github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dispatch(0xc00251ab40, {0x1a7d1e0, 0xc00296e840}, 0xc00167aac0)

github.com/xtls/xray-core/app/proxyman/outbound/handler.go:242 +0x992

created by github.com/xtls/xray-core/app/proxyman/outbound.(*Handler).Dial in goroutine 130

github.com/xtls/xray-core/app/proxyman/outbound/handler.go:289 +0xe30

Server log

N/A (this is a client-side issue, no server log required)

[Fangliding]

try https://github.com/XTLS/Xray-core/actions/runs/22273367201