Nuclei

Developer Tools

A fast, template-based vulnerability scanner driven by a community template library.

Latest v3.11.1 · by ProjectDiscoveryWebsiteprojectdiscovery/nuclei

Release activity

Release activity — 10 releases across 10 days since Dec 4, 2025. Each cell is one day; darker means more releases that day. Nothing is recorded before Dec 4, 2025. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 20261 release on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Apr 28, 2026No releases on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 2026No releases on Jun 16, 2026No releases on Jun 23, 20261 release on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
WednesdayNo releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 20261 release on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026
ThursdayNo releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 20261 release on Aug 8, 2026

10 releases since Dec 4, 2025

Changelog

v3.11.1

Added 7
  • Improve lua script with args and values
  • Add gRPC JavaScript library
  • Render element locators before lookup in headless protocol
  • Add duration fields to other events in protocols
  • Add DNSSEC DNS record types
  • Add per-execution result callback for thread-safe engine in SDK
  • Add nuclei/http JavaScript client
Changed 6
  • Reuse metadata cache across thread-safe scans
  • Improve MySQL JavaScript fingerprint with native handshake parsing
  • Improve MSSQL JavaScript fingerprint via TDS prelogin
  • Replace Split in loops with more efficient SplitSeq
  • Wire -max-time soft termination via goflags
  • Bind JavaScript execution to verified content in templates
Fixed 7
  • Avoid deprecated ECDSA coordinate access in signer
  • Guard against negative regex extractor group to avoid index-out-of-range panic
  • Preserve form parameters with shared prefixes in fuzz protocol
  • Fix raw HTTP parser panic on single-LF request body
  • Avoid panic for disabled stats interval in progress
  • Fix case-insensitive word matcher missing dynamic rendered values
  • Stop busy-spinning hang monitor
What's Changed
🎉 New Features
🐞 Bug Fixes
🔨 Maintenance
Other Changes
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.11.0...v3.11.1

View originalPermalink
How v3.11.1 went

v3.11.0

Security 1
  • Require digital signatures for custom templates using the javascript: protocol before they can be loaded or executed
What's Changed
⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

Why this change

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

Who is affected

ScenarioImpact
Default scans using nuclei-templatesNo action needed - official templates are pre-signed and verified with ProjectDiscovery's public key
Custom/private templates using javascript:Action required - sign templates before use
Templates using only flow: (e.g. flow: http(1)) without javascript:No change
Workflows referencing unsigned JavaScript sub-templatesThose sub-templates are skipped

What to do

Sign your custom templates with:

nuclei -sign -t /path/to/your-template.yaml

See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

🔒 Security
Other Changes

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.10.0...v3.11.0

View originalPermalink
How v3.11.0 went

v3.10.0

Added 1
  • Add per-host HTTP client pooling
Changed 1
  • Update govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input
Fixed 13
  • Fix handling in hosterrorscache to automatically skip hosts that consistently time out
  • Fix preservation of explicit target port in network templates
  • Fix connection reuse and improve port pre-flight handling
  • Fix ASCII-section regex to properly escape literal dot
  • Fix recording of decoded bytes for debug dumps
  • Fix proper escaping of dbname in lib/pq URLs
Security 5
  • Centralize opt-in capability gating across loaders and workflows
  • Gate allowAllFiles behind -lfa flag
  • Validate code template signatures before DAST loading
  • Update Goja dependency
  • Enforce template rendering boundary in DAST/fuzz mode
What's Changed
Security Fixes
  • Templates: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489)
  • JS/MySQL: Gate allowAllFiles behind -lfa by @dogancanbakir (#7473)
  • Templates: Validate code template signatures before DAST loading by @dogancanbakir (#7472)
  • JS: Update Goja dependency by @Mzack9999 (#7467)
  • Protocols: Enforce template rendering boundary in DAST/fuzz mode by @dwisiswant0 (#7499)
🎉 New Features
🐞 Bug Fixes
Other Changes
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.9.0...v3.10.0

View originalPermalink
How v3.10.0 went

v3.9.0

Added 4
  • Added support for protocol redirects
  • Added impacket integration
  • Added wmi, tsch, scmr, and dcom helper modules for JS
  • Added mirroring of -config, -report-config, and -dashboard flags for SDK callers
Changed 1
  • Split exact matches and pattern handling in catalog for improved performance
Fixed 14
  • Fixed DNS variables resolving issue
  • Fixed expressions to prefer exact placeholders over expressions
  • Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned
  • Fixed an issue in reporting/jira where status-not was not matched against the transition target status name
  • Fixed runner to write unsigned-templates warning (WRN) to stderr
  • Fixed InternalEvent access serialization in interactsh
Removed 1
  • Dropped vulnerable docker/docker dependency
What's Changed
🎉 New Features
🐞 Bug Fixes
Other Changes
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.8.0...v3.9.0

View originalPermalink
How v3.9.0 went

v3.8.0

Added 5
  • Add XSS reflection context analyzer to fuzz module
  • Add PDF export option for scan results
  • Support service names in port field for network templates
  • Add honeypot detection to reduce scan noise
  • Add inline targets and secrets to template profiles
Fixed 13
  • Respect annotations in unsafe mode for HTTP requests
  • Isolate project cache keys by scheme and host
  • Propagate unresolved variable markers through encoding functions
  • Respect WithOptions rate limit in SDK
  • Prevent path mutation across sequential Rebuild calls in fuzz module
  • Use actual parameter for frequency deduplication in fuzz module
Security 2
  • Respect allow-local-file-access in require for JS templates
  • Only evaluate template-authored expressions to prevent unauthorized code execution
What's Changed
Security Fixes
Bug Fixes
  • HTTP: Respect annotations in unsafe mode by @dwisiswant0 (#7044)
  • HTTP: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043)
  • Expressions: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033)
  • SDK: Respect WithOptions rate limit by @dwisiswant0 (#7342)
  • Fuzz: Prevent path mutation across sequential Rebuild calls by @promisingcoder (#7253)
  • Fuzz: Use actual parameter for frequency deduplication by @Godzilla675 (#7037)
  • Fuzz: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291)
  • Fuzz: Propagate custom headers to time_delay analyzer follow-up requests by @usernametooshort (#7125)
  • JS: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299)
  • JS: Interrupt goja runtime on context cancel by @mikhail5555 (#7343)
  • WebSocket: Fix path handling when merging template & target URLs by @Mzack9999 (#7290)
  • Runner: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129)
  • Input: Optimize removeTargets to prevent hang on large exclusions by @JawsKim (#6760)
  • Installer: Prevent unnecessary update checks by @dahezhiquan (#7337)
  • Utils: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045)
  • Client pool: Replace global variable with local scoping by @mikhail5555 (#7294)
  • Fix InFlight map race condition via Snapshot method by @n3integration (#7026)
  • Fix race condition in Dynamic.Fetch and always prefetch secrets by @hussain-alsaibai (#6976)
  • Fix nil interface set in createEphemeralObjects to prevent panic by @maxwolf8852 (#6944)
  • Fix DAST skipping URLs with part: request and mode: multiple by @dogancanbakir (#7326)
  • Fix headless JS loading with -tlsi and addheader/setheader by @dogancanbakir (#7325)
  • Fix flow execution with auth by @Mzack9999 (#7298)
  • Fix redirect handling by @Mzack9999 (#7286)
  • Fix Elastic export by @Mzack9999 (#7287)
  • Use crypto/rand instead of math/rand in JS global functions by @sandiyochristan (#7215)
New Features
  • Fuzz: Add XSS reflection context analyzer by @ZachL111 (#7164)
  • Reporting: Add PDF export option for scan results by @Gengyscan (#7254)
  • Network templates: Support service names in port field by @dogancanbakir (#7303)
  • Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277)
  • Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858)
Performance & Improvements
  • Runner: Fast path for tag listing by @dwisiswant0 (#7143)
  • Runner: Use Print instead for listAvailableStoreTags by @dwisiswant0 (#7145)
  • Resume state: Refactored as cache data by @dwisiswant0 (#7042)
  • Capture stderr output by @Mzack9999 (#7292)
Tests & CI
  • Add fuzz tests by @dwisiswant0 (#7311)
  • Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300)
  • Refactor native tests by @dwisiswant0 (#7307)
  • Add GITHUB_TOKEN to workflows for authenticated template updates by @dwisiswant0 (#7119)
  • Integrate typos spell checker into CI by @telewin95 (#7158)
Documentation
  • Update outdated documentation links across all translations by @Pitrat-wav (#7020)
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.7.1...v3.8.0

View originalPermalink
How v3.8.0 went

v3.7.1

Changed 2
  • Bump github.com/bytedance/sonic to 1.15.0 for Go 1.26 support
  • Expose cluster ids mapping to template ids in API
Fixed 4
  • Replace panic with error handling in template loader
  • Fix cluster failure handling
  • Avoid cross-test chrome teardown races in headless
  • Fix data race in evaluateVarsWithInteractsh
Removed 1
  • Remove double parsing in template loading
What's Changed
🐞 Bug Fixes
Other Changes
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.7.0...v3.7.1

View originalPermalink
How v3.7.1 went

v3.7.0

Added 2
  • Add `cdp-endpoint` option to allow users to specify a WebSocket endpoint for control in headless mode
  • Add RSYNC module
Changed 4
  • Replace seh-msft/burpxml with utils package
  • Improve telnet login and add crypto
  • Refactor WithNetworkConfig and WithInteractshOptions to be used by NewThreadSafeNucleiEngineCtx
  • Improve cache template signature verification performance
Fixed 10
  • Fix resume file path condition
  • Fix race condition regression
  • Fix duplicate log spam for permanent errors
  • Fix `ExecutionId` initialization in `DefaultOptions` function
  • Fix handling full URLs in unsafe raw requests
  • Fix segfault in workflow parsing with global-matchers templates
Removed 1
  • Remove genproto replace directives from go.mod
What's Changed
🎉 New Features
🐞 Bug Fixes
Other Changes
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.6.2...v3.7.0

View originalPermalink
How v3.7.0 went

v3.6.2

Added 2
  • Enable TLS session caching in the client pool to improve connection reuse and reduce handshake overhead
  • Add support for providing a custom Jira server URL (site-url) when using OAuth authentication
Changed 2
  • Optimize the MergeMaps generator to reduce memory allocations
  • Update projectdiscovery/utils to v0.8.0 to fix a deadlock in httputil.ResponseChain
Fixed 6
  • Improve duplicate issue detection by properly paginating Gitea issue searches
  • Restore JavaScript template execution when the Port argument is not provided
  • Add pagination support when searching for duplicate issues in GitLab
  • Correct an incorrect PostgreSQL execution call signature in the JavaScript engine
  • Fix a MySQL panic caused by a missing executionId in the execution context
  • Fix a segmentation fault in flow execution related to hasMatchers
What's Changed
✨ New Features
  • Enabled TLS session caching in the client pool to improve connection reuse and reduce handshake overhead (internal) by @dwisiswant0 in #6713
  • Added support for providing a custom Jira server URL (site-url) when using OAuth authentication by @Ice3man543 in #6716
🐞 Bug Fixes
  • Improved duplicate issue detection by properly paginating Gitea issue searches by @leonjza in #6707
  • Restored JavaScript template execution when the Port argument is not provided by @dwisiswant0 in #6709
  • Added pagination support when searching for duplicate issues in GitLab by @dwisiswant0 in #6712
  • Corrected an incorrect PostgreSQL execution call signature in the JavaScript engine by @Mzack9999 in #6731
  • Fixed a MySQL panic caused by a missing executionId in the execution context by @dwisiswant0 in #6735
  • Fixed a segmentation fault in flow execution related to hasMatchers by @dwisiswant0 in #6739
⚡ Performance Improvements
  • Optimized the MergeMaps generator to reduce memory allocations by @dwisiswant0 in #6718
🔧 Maintenance
  • Updated projectdiscovery/utils to v0.8.0 to fix a deadlock in httputil.ResponseChain by @dwisiswant0 in #6723
  • Introduced a PowerShell integration test to improve cross-platform test coverage by @Mzack9999 in #6724
  • Updated multiple Go module dependencies across two dependency refreshes by @dependabot[bot] in #6729 & #6741
Other Changes
  • Updated issue and pull request templates by @dwisiswant0 in #6673
  • Refactored CI workflows by @dwisiswant0 in #6728, this includes:
    • Shipping binaries with Green Tea GC enabled via GOEXPERIMENT
    • Shipping binaries built with profile-guided optimization (PGO)
    • Fixing an auto-merge workflow that never triggered
  • Switched release tests to use a stable Go version by @dwisiswant0 in #6737
  • Upgraded actions/download-artifact from v6 to v7 in GitHub workflows by @dependabot[bot] in #6742
  • Updated compatibility checks to use a stable Go version by @dwisiswant0 in #6743

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.6.1...v3.6.2

View originalPermalink
How v3.6.2 went

v3.6.1

Changed 1
  • bump fastdialer to v0.4.20 to fix greater than 10s delays
Fixed 10
  • template exclusion logic for paths with reserved names
  • lost request body on retries and redirects
  • pass dynamicValues to EvaluateWithInteractsh
  • segfault when initializing the engine with EnableHeadlessWithOpts
  • compilation on loong64 architecture
  • enable all template types for template list and display
What’s Changed
🐞 Bug Fixes
  • fix(config): template exclusion logic for paths with reserved names by @dwisiswant0 in #6663
  • fix(http): lost request body on retries & redirects by @dwisiswant0 in #6666
  • fix(http): pass dynamicValues to EvaluateWithInteractsh by @dwisiswant0 in #6685
  • fix(lib): segfault when initializing the engine with EnableHeadlessWithOpts by @dwisiswant0 in #6602
  • build: fix compilation on loong64 architecture by @dwisiswant0 in #6667
  • fix: enable all template types for template list and display by @dwisiswant0 in #6668
  • fix(http): cache response strings to reduce memory allocations by @dwisiswant0 in #6679
  • fix: body loss on retries/redirects in remaining paths by @dwisiswant0 in #6693
  • fix(headless): data race when reading page history by @dwisiswant0 in #6687
  • fix(update): handle empty folder edge case during template updates by @Mzack9999 in #6573
🔨 Maintenance
  • chore: run goimports to format the codebase by @stringscut in #6691
  • chore(deps): bump fastdialer to v0.4.20 to fix >10s delays by @dwisiswant0 in #6688
  • chore(deps): bump Go modules (10 updates) by @dependabot[bot] in #6675
  • chore(deps): bump Go modules (7 updates) by @dependabot[bot] in #6698
  • chore(deps): bump GitHub workflows (2 updates) by @dependabot[bot] in #6699
📚 Documentation
  • docs: fix typos in multiple files by @didier-durand in #6653
  • docs: fix additional typos across various files by @didier-durand in #6661
  • docs: typos and minor improvements by @AaryanBansal-dev in #6669
New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.6.0...v3.6.1

View originalPermalink
How v3.6.1 went

v3.6.0

Added 6
  • Write resume file specified by flag
  • Javascript multi-port support
  • Direct fuzzing using target URL for OpenAPI/Swagger
  • Bump DSL with .NET deserialization helpers
  • Implement persistent metadata cache in loader
  • Check for undefined params for lazy evaluation in variables
Fixed 3
  • Configure tmpDir for SDK
  • Skip DNS lookups on Interactsh domains
  • Restore parallel processing in file protocol

What's Changed

✨ New Features
  • Write resume file specified by flag by @circleous (#6616)
  • Javascript Multi-Port Support by @pussycat0x (#6501)
  • Direct fuzzing using target URL for OpenAPI/Swagger by @roiswd (#6542)
  • Bump DSL with .NET deserialization helpers by @Ice3man543 (#6625)
  • Implement persistent metadata cache in loader by @dwisiswant0 (#6630)
  • Check for undefined params for lazy evaluation in variables by @dwisiswant0 (#6618)
🐛 Fixed
  • Configure tmpDir for SDK by @AuditeMarlow (#6596)
  • Skip DNS lookups on Interactsh domains by @dwisiswant0 (#6614)
  • Restore parallel processing in file protocol by @dwisiswant0 (#6493)
⚙️ Changed / Improvements
  • Enable BenchmarkRunEnumeration/Default benchmark by @dwisiswant0 (#6603)
  • Cache Go-rod browser in CI by @dwisiswant0 (#6640)
  • Apply free-disk-space check on tests by @dwisiswant0 (#6642)
  • Disable stale workflow for enhancements by @dogancanbakir (#6637)
  • Omit unnecessary reassignment by @ledigang (#6622)
🧹 Maintenance / Dependencies
  • Bump the modules group with 6 updates by @dependabot[bot] (#6615)
  • Bump actions/checkout from 5 to 6 in workflows by @dependabot[bot] (#6628)
  • Bump PD modules & update httputil calls by @dependabot[bot] (#6629)
  • Bump the modules group with 11 updates by @dependabot[bot] (#6646)
  • Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] (#6621)
  • Bump github.com/projectdiscovery/fastdialer@v0.4.16 by @dwisiswant0 (#6624)
🌱 New Contributors

Full Changelog: v3.5.1 → v3.6.0

View originalPermalink
How v3.6.0 went

More in Developer Tools

View all
yt-dlp

A feature-rich command-line audio/video downloader

yt-dlp
tmux

tmux release notes.

tmux
GitHub CLI

GitHub command-line tool

GitHub
Claude Code

Anthropic's agentic coding tool for the terminal, IDE and web.

Anthropic
Shadowrocket

Rule based proxy utility client for iPhone/iPad.

Shadow Launch Technology Limited
AWS CLI

One tool to manage every AWS service from the command line, and script them.

Amazon Web Services

Discussion