diff --git a/internal/modules/executor.go b/internal/modules/executor.go
index f969581a..0dcc9e90 100644
--- a/internal/modules/executor.go
+++ b/internal/modules/executor.go
@@ -487,7 +487,7 @@ func runExtractors(extractors []Extractor, resp *http.Response, body string) map
 					continue
 				}
 				matches := re.FindStringSubmatch(part)
-				if len(matches) > e.Group {
+				if e.Group >= 0 && len(matches) > e.Group {
 					result[e.Name] = matches[e.Group]
 					break
 				}
diff --git a/internal/modules/matchers_test.go b/internal/modules/matchers_test.go
index 30834f11..eff21893 100644
--- a/internal/modules/matchers_test.go
+++ b/internal/modules/matchers_test.go
@@ -333,6 +333,14 @@ func TestRunExtractors(t *testing.T) {
 			},
 			wantNil: true,
 		},
+		{
+			// a negative group must be skipped, not panic on matches[-1].
+			name: "negative group is skipped",
+			extractors: []Extractor{
+				{Type: "regex", Name: "session", Part: "body", Regex: []string{`"session":"([^"]+)"`}, Group: -1},
+			},
+			wantNil: true,
+		},
 		{
 			name: "invalid pattern is skipped, no capture",
 			extractors: []Extractor{