# Nuclei changelog > A fast, template-based vulnerability scanner driven by a community template library. - Vendor: ProjectDiscovery - Category: Developer Tools - Official site: https://projectdiscovery.io - Tracked by: What's New (https://whatsnew.fyi/product/nuclei) - Harvested from: GitHub (projectdiscovery/nuclei) - Entries below: 10 (newest first) What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. ## Releases ### v3.11.1 - Date: 2026-08-08 - Version: v3.11.1 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.1 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.11.1 - **added** — Improve lua script with args and values - **added** — Add gRPC JavaScript library - **added** — Render element locators before lookup in headless protocol - **added** — Add duration fields to other events in protocols - **added** — Add DNSSEC DNS record types - **added** — Add per-execution result callback for thread-safe engine in SDK - **added** — Add nuclei/http JavaScript client - **changed** — Reuse metadata cache across thread-safe scans - **changed** — Improve MySQL JavaScript fingerprint with native handshake parsing - **changed** — Improve MSSQL JavaScript fingerprint via TDS prelogin - **changed** — Replace Split in loops with more efficient SplitSeq - **changed** — Wire -max-time soft termination via goflags - **changed** — Bind JavaScript execution to verified content in templates - **fixed** — Avoid deprecated ECDSA coordinate access in signer - **fixed** — Guard against negative regex extractor group to avoid index-out-of-range panic - **fixed** — Preserve form parameters with shared prefixes in fuzz protocol - **fixed** — Fix raw HTTP parser panic on single-LF request body - **fixed** — Avoid panic for disabled stats interval in progress - **fixed** — Fix case-insensitive word matcher missing dynamic rendered values - **fixed** — Stop busy-spinning hang monitor ##### What's Changed ###### 🎉 New Features * Improving lua script with args and values by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6561 ###### 🐞 Bug Fixes * feat(lib): reuse metadata cache across thread-safe scans by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7608 ###### 🔨 Maintenance * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7528 * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7532 * chore(deps): bump crate-ci/typos from 1.47.2 to 1.48.0 in the workflows group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7529 * chore(deps): bump the modules group with 3 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7554 * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7615 * chore(deps): bump the modules group with 3 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7634 * chore(deps): bump actions/stale from 10 to 11 in the workflows group by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7635 ###### Other Changes * gRPC JavaScript library by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7527 * chore(deps): bump the go_modules group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7533 * fix(signer): avoid deprecated ECDSA coordinate access by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7537 * feat(headless): render element locators before lookup by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7549 * Guard against a negative regex extractor group to avoid an index-out-of-range panic by @arpitjain099 in https://github.com/projectdiscovery/nuclei/pull/7531 * fix(fuzz): preserve form parameters with shared prefixes by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7515 * Fix raw HTTP parser panic on single-LF request body by @zainnadeem786 in https://github.com/projectdiscovery/nuclei/pull/7525 * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7555 * fix(progress): avoid panic for disabled stats interval by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7557 * Fix case-insensitive `word` matcher missing dynamic (rendered) values by @Synvoya in https://github.com/projectdiscovery/nuclei/pull/7523 * fix: stop busy-spinning hang monitor by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7559 * feat(protocols): add duration fields to other events by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7428 * refactor: replace Split in loops with more efficient SplitSeq by @stringsbuilder in https://github.com/projectdiscovery/nuclei/pull/7278 * fix(index): limit include-tags to matching tag exclusions by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7536 * Add DNSSEC DNS record types by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7564 * chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7594 * sdk: per-execution result callback for thread-safe engine by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7587 * docs: missing CLI flags in README by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7596 * cli: wire -max-time soft termination via goflags by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7589 * http tlsmeta by @Mzack9999 _[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.1]_ ### v3.11.0 - Date: 2026-07-06 - Version: v3.11.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.11.0 - **security** — Require digital signatures for custom templates using the javascript: protocol before they can be loaded or executed ##### What's Changed ###### ⚠️ Breaking Change: Signed templates required for JavaScript protocol Starting with v3.11.0, **custom templates that use the `javascript:` protocol must be digitally signed** before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows. **Why this change** This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in [#7469](https://github.com/projectdiscovery/nuclei/pull/7469)). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates. **Who is affected** | Scenario | Impact | |----------|--------| | Default scans using [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) | **No action needed** - official templates are pre-signed and verified with ProjectDiscovery's public key | | Custom/private templates using `javascript:` | **Action required** - sign templates before use | | Templates using only `flow:` (e.g. `flow: http(1)`) without `javascript:` | **No change** | | Workflows referencing unsigned JavaScript sub-templates | Those sub-templates are skipped | **What to do** Sign your custom templates with: ```bash nuclei -sign -t /path/to/your-template.yaml ``` See the [Template Signing documentation](https://docs.projectdiscovery.io/templates/reference/template-signing) for key generation, verification, and signing templates that reference external JavaScript or code files. --- ###### 🔒 Security * feat(templates): require signatures for javascript templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7514 ###### Other Changes * bump x/crypto and go-pkcs12 by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7516 * general maintenance and cleanup by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7469 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.10.0...v3.11.0 ### v3.10.0 - Date: 2026-06-30 - Version: v3.10.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.10.0 - **security** — Centralize opt-in capability gating across loaders and workflows - **security** — Gate allowAllFiles behind -lfa flag - **security** — Validate code template signatures before DAST loading - **security** — Update Goja dependency - **security** — Enforce template rendering boundary in DAST/fuzz mode - **added** — Add per-host HTTP client pooling - **fixed** — Fix handling in hosterrorscache to automatically skip hosts that consistently time out - **fixed** — Fix preservation of explicit target port in network templates - **fixed** — Fix connection reuse and improve port pre-flight handling - **fixed** — Fix ASCII-section regex to properly escape literal dot - **fixed** — Fix recording of decoded bytes for debug dumps - **fixed** — Fix proper escaping of dbname in lib/pq URLs - **fixed** — Fix network policy enforcement prior to LDAP dialing - **fixed** — Fix normalization and rejection of trace file DSN options in Oracle - **fixed** — Fix proper escaping of MSSQL database names in connection URLs - **fixed** — Fix krbforge to reject unsandboxed ccache writes - **fixed** — Fix rejection of request-condition(s) during fuzzing - **fixed** — Fix YAML to correctly reject recursive include chains - **fixed** — Fix resource leaks - **changed** — Update govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input ##### What's Changed ###### Security Fixes - **Templates**: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489) - [GHSA-qgw5-7j4f-fg97](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-qgw5-7j4f-fg97) - **JS/MySQL**: Gate `allowAllFiles` behind `-lfa` by @dogancanbakir (#7473) - [GHSA-xhmx-w2j4-rw3q](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-xhmx-w2j4-rw3q) - **Templates**: Validate code template signatures before DAST loading by @dogancanbakir (#7472) - [GHSA-jpf4-98qj-qr67](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpf4-98qj-qr67) - **JS**: Update Goja dependency by @Mzack9999 (#7467) - [GHSA-vxg7-f2jj-jmqm](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-vxg7-f2jj-jmqm) - **Protocols**: Enforce template rendering boundary in DAST/fuzz mode by @dwisiswant0 (#7499) - [GHSA-jpvm-9frm-hjcq](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jpvm-9frm-hjcq) ###### 🎉 New Features * Added per-host HTTP client pooling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7301 ###### 🐞 Bug Fixes * Fixed handling in hosterrorscache to automatically skip hosts that consistently time out by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/7455 * Fixed preservation of explicit target port in network templates (fixes #7323) by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7465 * Fixed connection reuse and improved port pre-flight handling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6715 * Fixed ASCII-section regex to properly escape literal `.` by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7476 * Fixed recording of decoded bytes for debug dumps by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7478 * Fixed proper escaping of dbname in lib/pq URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7479 * Fixed network policy enforcement prior to LDAP dialing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7494 * Fixed normalization and rejection of trace file DSN options in Oracle by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7480 * Fixed proper escaping of MSSQL database names in connection URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7481 * Fixed krbforge to reject unsandboxed ccache writes by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7482 * Fixed rejection of request-condition(s) during fuzzing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7466 * Fixed: YAML now correctly rejects recursive include chains by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7492 * Fixed resource leaks by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7502 ###### Other Changes * Updated govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7464 * Updated dependencies to remove unused packages by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7457 * Added fuzzing parser harnesses for raw requests and templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7459 ##### New Contributors * @XananasX7 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7465 * @snicket2100 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7476 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.9.0...v3.10.0 ### v3.9.0 - Date: 2026-06-10 - Version: v3.9.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.9.0 - **added** — Added support for protocol redirects - **added** — Added impacket integration - **added** — Added wmi, tsch, scmr, and dcom helper modules for JS - **added** — Added mirroring of -config, -report-config, and -dashboard flags for SDK callers - **fixed** — Fixed DNS variables resolving issue - **fixed** — Fixed expressions to prefer exact placeholders over expressions - **fixed** — Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned - **fixed** — Fixed an issue in reporting/jira where status-not was not matched against the transition target status name - **fixed** — Fixed runner to write unsigned-templates warning (WRN) to stderr - **fixed** — Fixed InternalEvent access serialization in interactsh - **fixed** — Fixed workflow to ensure context is properly propagated to child and race steps - **fixed** — Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64 - **fixed** — Fixed memogen to skip context correctly and auto-push scope to upstream - **fixed** — Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges - **fixed** — Fixed SMBv1 probing in JS to occur after SMB2 negotiation - **fixed** — Fixed templates to reject unknown fields when loading JSON templates - **fixed** — Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy - **fixed** — Fixed loader to warn when templates are excluded by .nuclei-ignore tags - **changed** — Split exact matches and pattern handling in catalog for improved performance - **removed** — Dropped vulnerable docker/docker dependency ##### What's Changed ###### 🎉 New Features * Added support for protocol redirects by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7296 * Added impacket integration by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7356 * Added wmi, tsch, scmr, and dcom helper modules for JS by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7388 * Added mirroring of -config, -report-config, and -dashboard flags for SDK callers by @ShubhamRasal in https://github.com/projectdiscovery/nuclei/pull/7393 ###### 🐞 Bug Fixes * Fixed DNS variables resolving issue by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7379 * Fixed expressions to prefer exact placeholders over expressions by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7397 * Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned, by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7378 * Fixed an issue in reporting/jira where status-not was not matched against the transition target status name by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/7361 * Fixed runner to write unsigned-templates warning (WRN) to stderr by @ChrisJr404 in https://github.com/projectdiscovery/nuclei/pull/7371 * Fixed `InternalEvent` access serialization in interactsh by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7322 * Fixed workflow to ensure context is properly propagated to child and race steps by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7383 * Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64 by @ShubhamRasal in https://github.com/projectdiscovery/nuclei/pull/7398 * Fixed memogen to skip context correctly and auto-push scope to upstream by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7419 * Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges by @tejgokani in https://github.com/projectdiscovery/nuclei/pull/7425 * Fixed SMBv1 probing in JS to occur after SMB2 negotiation by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7430 * Fixed templates to reject unknown fields when loading JSON templates by @tejgokani in https://github.com/projectdiscovery/nuclei/pull/7453 * Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy by @akhilesharora in https://github.com/projectdiscovery/nuclei/pull/7410 * Fixed loader to warn when templates are excluded by `.nuclei-ignore` tags by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7452 ###### Other Changes * Splitted exact matches and pattern handling in catalog for improved performance by @mikhail5555 in https://github.com/projectdiscovery/nuclei/pull/7340 * Updated README_PT-BR.md to reflect current project description and features by @gugacyber in https://github.com/projectdiscovery/nuclei/pull/7405 * Fixed broken cloud scanning link by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7413 * Bumped pdsec modules + govaluate/aurora migration by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7414 * Dropped vulnerable docker/docker dependency by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7447 * Used path-aware filesystem containment checks by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7420 * Centralized runtime session handling by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7449 ##### New Contributors * @ChrisJr404 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7371 * @gugacyber made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7405 * @akhilesharora made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7410 * @tejgokani made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7425 **Ful _[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0]_ ### v3.8.0 - Date: 2026-04-18 - Version: v3.8.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.8.0 - **security** — Respect allow-local-file-access in require for JS templates - **security** — Only evaluate template-authored expressions to prevent unauthorized code execution - **added** — Add XSS reflection context analyzer to fuzz module - **added** — Add PDF export option for scan results - **added** — Support service names in port field for network templates - **added** — Add honeypot detection to reduce scan noise - **added** — Add inline targets and secrets to template profiles - **fixed** — Respect annotations in unsafe mode for HTTP requests - **fixed** — Isolate project cache keys by scheme and host - **fixed** — Propagate unresolved variable markers through encoding functions - **fixed** — Respect WithOptions rate limit in SDK - **fixed** — Prevent path mutation across sequential Rebuild calls in fuzz module - **fixed** — Use actual parameter for frequency deduplication in fuzz module - **fixed** — Fix concurrent map writes in multipart form parsing for fuzz - **fixed** — Propagate custom headers to time_delay analyzer follow-up requests - **fixed** — Fix watchdog and propagate context to all JS library network calls - **fixed** — Interrupt goja runtime on context cancel - **fixed** — Fix path handling when merging template and target URLs in WebSocket - **fixed** — Stop spawning template goroutines in host-spray when host is unresponsive - **fixed** — Optimize removeTargets to prevent hang on large exclusions ##### What's Changed ###### Security Fixes - **JS**: Respect `allow-local-file-access` in `require` by @dwisiswant0 (#7332) - [CVE-2026-41646 - GHSA-29rg-wmcw-hpf4](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4) - **Expressions**: Only evaluate template-authored expressions by @dwisiswant0 (#7221)(#7321) - [CVE-2026-41645 - GHSA-jm34-66cf-qpvr](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr) ###### Bug Fixes - **HTTP**: Respect `annotations` in `unsafe` mode by @dwisiswant0 (#7044) - **HTTP**: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043) - **Expressions**: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033) - **SDK**: Respect `WithOptions` rate limit by @dwisiswant0 (#7342) - **Fuzz**: Prevent path mutation across sequential `Rebuild` calls by @promisingcoder (#7253) - **Fuzz**: Use actual parameter for frequency deduplication by @Godzilla675 (#7037) - **Fuzz**: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291) - **Fuzz**: Propagate custom headers to `time_delay` analyzer follow-up requests by @usernametooshort (#7125) - **JS**: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299) - **JS**: Interrupt goja runtime on context cancel by @mikhail5555 (#7343) - **WebSocket**: Fix path handling when merging template & target URLs by @Mzack9999 (#7290) - **Runner**: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129) - **Input**: Optimize `removeTargets` to prevent hang on large exclusions by @JawsKim (#6760) - **Installer**: Prevent unnecessary update checks by @dahezhiquan (#7337) - **Utils**: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045) - **Client pool**: Replace global variable with local scoping by @mikhail5555 (#7294) - Fix `InFlight` map race condition via `Snapshot` method by @n3integration (#7026) - Fix race condition in `Dynamic.Fetch` and always prefetch secrets by @hussain-alsaibai (#6976) - Fix nil interface set in `createEphemeralObjects` to prevent panic by @maxwolf8852 (#6944) - Fix DAST skipping URLs with `part: request` and `mode: multiple` by @dogancanbakir (#7326) - Fix headless JS loading with `-tlsi` and `addheader`/`setheader` by @dogancanbakir (#7325) - Fix flow execution with auth by @Mzack9999 (#7298) - Fix redirect handling by @Mzack9999 (#7286) - Fix Elastic export by @Mzack9999 (#7287) - Use `crypto/rand` instead of `math/rand` in JS global functions by @sandiyochristan (#7215) ###### New Features - **Fuzz**: Add XSS reflection context analyzer by @ZachL111 (#7164) - **Reporting**: Add PDF export option for scan results by @Gengyscan (#7254) - **Network templates**: Support service names in port field by @dogancanbakir (#7303) - Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277) - Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858) ###### Performance & Improvements - **Runner**: Fast path for tag listing by @dwisiswant0 (#7143) - **Runner**: Use `Print` instead for `listAvailableStoreTags` by @dwisiswant0 (#7145) - **Resume state**: Refactored as cache data by @dwisiswant0 (#7042) - Capture stderr output by @Mzack9999 (#7292) ###### Tests & CI - Add fuzz tests by @dwisiswant0 (#7311) - Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300) - Refactor native tests by @dwisiswant0 (#7307) - Add `GITHUB_TOKEN` to workflows for authenticated template updates by @dwisiswant0 (#7119) - Integrate typos spell checker into CI by @telewin95 (#7158) ###### Documentation - Update outdated documentation links across all translations by @Pitrat-wav (#7020) ##### New Contributors * @usernametooshort made the _[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0]_ ### v3.7.1 - Date: 2026-03-05 - Version: v3.7.1 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.1 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.7.1 - **fixed** — Replace panic with error handling in template loader - **fixed** — Fix cluster failure handling - **fixed** — Avoid cross-test chrome teardown races in headless - **fixed** — Fix data race in evaluateVarsWithInteractsh - **removed** — Remove double parsing in template loading - **changed** — Bump github.com/bytedance/sonic to 1.15.0 for Go 1.26 support - **changed** — Expose cluster ids mapping to template ids in API ##### What's Changed ###### 🐞 Bug Fixes * Fixed panic by replacing it with error handling in template loader (#6674) by @umer12-12 in https://github.com/projectdiscovery/nuclei/pull/7090 * Fixed cluster failure handling by @bf-rbrown in https://github.com/projectdiscovery/nuclei/pull/6843 * Fixed by avoiding cross-test chrome teardown races in headless by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7053 * Fixed data race in evaluateVarsWithInteractsh by @yusei-wy in https://github.com/projectdiscovery/nuclei/pull/6828 * Fixed panic by replacing it with error handling in template loader by @bimakw in https://github.com/projectdiscovery/nuclei/pull/6825 ###### Other Changes * Added memogen workflow by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6736 * Removed double parsing in template loading by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6796 * Bumped github.com/bytedance/sonic to 1.15.0 for Go 1.26 support by @stefanb in https://github.com/projectdiscovery/nuclei/pull/6841 * Improved API by exposing cluster ids mapping to template ids by @yaron12n in https://github.com/projectdiscovery/nuclei/pull/6788 ##### New Contributors * @yusei-wy made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6828 * @yaron12n made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6788 * @bimakw made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6825 * @umer12-12 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7090 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.7.0...v3.7.1 ### v3.7.0 - Date: 2026-01-28 - Version: v3.7.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.7.0 - **added** — Add `cdp-endpoint` option to allow users to specify a WebSocket endpoint for control in headless mode - **added** — Add RSYNC module - **fixed** — Fix resume file path condition - **fixed** — Fix race condition regression - **fixed** — Fix duplicate log spam for permanent errors - **fixed** — Fix `ExecutionId` initialization in `DefaultOptions` function - **fixed** — Fix handling full URLs in unsafe raw requests - **fixed** — Fix segfault in workflow parsing with global-matchers templates - **fixed** — Fix logging update summary table to stderr - **fixed** — Fix sanitizing host when target has host port - **fixed** — Fix interactsh matching with `payloads` - **fixed** — Fix passing template variables to TCP inputs pre-compilation - **changed** — Replace seh-msft/burpxml with utils package - **removed** — Remove genproto replace directives from go.mod - **changed** — Improve telnet login and add crypto - **changed** — Refactor WithNetworkConfig and WithInteractshOptions to be used by NewThreadSafeNucleiEngineCtx - **changed** — Improve cache template signature verification performance ##### What's Changed ###### 🎉 New Features * Added `cdp-endpoint` option to allow users to specify a WebSocket endpoint for control in headless mode by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/5786 * Added RSYNC module by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6410 ###### 🐞 Bug Fixes * Fixed resume file path condition by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/6784 * Fixed race condition regression by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6748 * Fixed duplicate log spam for permanent errors by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6697 * Fixed `ExecutionId` initialization in `DefaultOptions` function by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/6598 * Fixed handling full URLs in unsafe raw requests by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6589 * Fixed segfault in workflow parsing with global-matchers templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6774 * Fixed logging update summary table to stderr by @ayuxsec in https://github.com/projectdiscovery/nuclei/pull/6769 * Fixed sanitizing host when target has host port by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/6759 * Fixed interactsh matching with `payloads` by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6778 * Fixed passing template variables to TCP inputs pre-compilation by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/6776 ###### Other Changes * Replaced seh-msft/burpxml with utils package by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/6763 * Removed genproto replace directives from go.mod by @ehsandeep in https://github.com/projectdiscovery/nuclei/pull/6608 * Improved telnet login and added crypto by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6419 * Added Turkish README and enhanced CONTRIBUTING.md by @bahattinyunus in https://github.com/projectdiscovery/nuclei/pull/6740 * Refactored WithNetworkConfig and WithInteractshOptions to be used by NewThreadSafeNucleiEngineCtx by @meme-lord in https://github.com/projectdiscovery/nuclei/pull/5972 * Improved cache template signature verification performance by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/6779 ##### New Contributors * @bahattinyunus made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6740 * @promalert made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6756 * @ayuxsec made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6769 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.6.2...v3.7.0 ### v3.6.2 - Date: 2025-12-31 - Version: v3.6.2 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.2 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.6.2 - **added** — Enable TLS session caching in the client pool to improve connection reuse and reduce handshake overhead - **added** — Add support for providing a custom Jira server URL (site-url) when using OAuth authentication - **fixed** — Improve duplicate issue detection by properly paginating Gitea issue searches - **fixed** — Restore JavaScript template execution when the Port argument is not provided - **fixed** — Add pagination support when searching for duplicate issues in GitLab - **fixed** — Correct an incorrect PostgreSQL execution call signature in the JavaScript engine - **fixed** — Fix a MySQL panic caused by a missing executionId in the execution context - **fixed** — Fix a segmentation fault in flow execution related to hasMatchers - **changed** — Optimize the MergeMaps generator to reduce memory allocations - **changed** — Update projectdiscovery/utils to v0.8.0 to fix a deadlock in httputil.ResponseChain ##### What's Changed ###### ✨ New Features * Enabled TLS session caching in the client pool to improve connection reuse and reduce handshake overhead _(internal)_ by @dwisiswant0 in #6713 * Added support for providing a custom Jira server URL (`site-url`) when using OAuth authentication by @Ice3man543 in #6716 ###### 🐞 Bug Fixes * Improved duplicate issue detection by properly paginating Gitea issue searches by @leonjza in #6707 * Restored JavaScript template execution when the `Port` argument is not provided by @dwisiswant0 in #6709 * Added pagination support when searching for duplicate issues in GitLab by @dwisiswant0 in #6712 * Corrected an incorrect PostgreSQL execution call signature in the JavaScript engine by @Mzack9999 in #6731 * Fixed a MySQL panic caused by a missing `executionId` in the execution context by @dwisiswant0 in #6735 * Fixed a segmentation fault in flow execution related to `hasMatchers` by @dwisiswant0 in #6739 ###### ⚡ Performance Improvements * Optimized the `MergeMaps` generator to reduce memory allocations by @dwisiswant0 in #6718 ###### 🔧 Maintenance * Updated `projectdiscovery/utils` to v0.8.0 to fix a deadlock in `httputil.ResponseChain` by @dwisiswant0 in #6723 * Introduced a PowerShell integration test to improve cross-platform test coverage by @Mzack9999 in #6724 * Updated multiple Go module dependencies across two dependency refreshes by @dependabot[bot] in #6729 & #6741 ###### Other Changes * Updated issue and pull request templates by @dwisiswant0 in #6673 * Refactored CI workflows by @dwisiswant0 in #6728, this includes: * Shipping binaries with Green Tea GC enabled via `GOEXPERIMENT` * Shipping binaries built with profile-guided optimization (PGO) * Fixing an auto-merge workflow that never triggered * Switched release tests to use a stable Go version by @dwisiswant0 in #6737 * Upgraded `actions/download-artifact` from v6 to v7 in GitHub workflows by @dependabot[bot] in #6742 * Updated compatibility checks to use a stable Go version by @dwisiswant0 in #6743 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.6.1...v3.6.2 ### v3.6.1 - Date: 2025-12-16 - Version: v3.6.1 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.1 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.6.1 - **fixed** — template exclusion logic for paths with reserved names - **fixed** — lost request body on retries and redirects - **fixed** — pass dynamicValues to EvaluateWithInteractsh - **fixed** — segfault when initializing the engine with EnableHeadlessWithOpts - **fixed** — compilation on loong64 architecture - **fixed** — enable all template types for template list and display - **fixed** — cache response strings to reduce memory allocations - **fixed** — body loss on retries and redirects in remaining paths - **fixed** — data race when reading page history in headless - **fixed** — handle empty folder edge case during template updates - **changed** — bump fastdialer to v0.4.20 to fix greater than 10s delays ##### What’s Changed ###### 🐞 Bug Fixes * fix(config): template exclusion logic for paths with reserved names by @dwisiswant0 in #6663 * fix(http): lost request body on retries & redirects by @dwisiswant0 in #6666 * fix(http): pass `dynamicValues` to `EvaluateWithInteractsh` by @dwisiswant0 in #6685 * fix(lib): segfault when initializing the engine with `EnableHeadlessWithOpts` by @dwisiswant0 in #6602 * build: fix compilation on loong64 architecture by @dwisiswant0 in #6667 * fix: enable all template types for template list and display by @dwisiswant0 in #6668 * fix(http): cache response strings to reduce memory allocations by @dwisiswant0 in #6679 * fix: body loss on retries/redirects in remaining paths by @dwisiswant0 in #6693 * fix(headless): data race when reading page history by @dwisiswant0 in #6687 * fix(update): handle empty folder edge case during template updates by @Mzack9999 in #6573 ###### 🔨 Maintenance * chore: run goimports to format the codebase by @stringscut in #6691 * chore(deps): bump fastdialer to v0.4.20 to fix >10s delays by @dwisiswant0 in #6688 * chore(deps): bump Go modules (10 updates) by @dependabot[bot] in #6675 * chore(deps): bump Go modules (7 updates) by @dependabot[bot] in #6698 * chore(deps): bump GitHub workflows (2 updates) by @dependabot[bot] in #6699 ###### 📚 Documentation * docs: fix typos in multiple files by @didier-durand in #6653 * docs: fix additional typos across various files by @didier-durand in #6661 * docs: typos and minor improvements by @AaryanBansal-dev in #6669 ##### New Contributors * @didier-durand made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6653 * @AaryanBansal-dev made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6669 * @stringscut made their first contribution in https://github.com/projectdiscovery/nuclei/pull/6691 **Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.6.0...v3.6.1 ### v3.6.0 - Date: 2025-12-04 - Version: v3.6.0 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.0 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.6.0 - **added** — Write resume file specified by flag - **added** — Javascript multi-port support - **added** — Direct fuzzing using target URL for OpenAPI/Swagger - **added** — Bump DSL with .NET deserialization helpers - **added** — Implement persistent metadata cache in loader - **added** — Check for undefined params for lazy evaluation in variables - **fixed** — Configure tmpDir for SDK - **fixed** — Skip DNS lookups on Interactsh domains - **fixed** — Restore parallel processing in file protocol #### What's Changed ##### ✨ New Features - Write resume file specified by flag by @circleous ([#6616](https://github.com/projectdiscovery/nuclei/pull/6616)) - Javascript Multi-Port Support by @pussycat0x ([#6501](https://github.com/projectdiscovery/nuclei/pull/6501)) - Direct fuzzing using target URL for OpenAPI/Swagger by @roiswd ([#6542](https://github.com/projectdiscovery/nuclei/pull/6542)) - Bump DSL with .NET deserialization helpers by @Ice3man543 ([#6625](https://github.com/projectdiscovery/nuclei/pull/6625)) - Implement persistent metadata cache in loader by @dwisiswant0 ([#6630](https://github.com/projectdiscovery/nuclei/pull/6630)) - Check for undefined params for lazy evaluation in variables by @dwisiswant0 ([#6618](https://github.com/projectdiscovery/nuclei/pull/6618)) ##### 🐛 Fixed - Configure `tmpDir` for SDK by @AuditeMarlow ([#6596](https://github.com/projectdiscovery/nuclei/pull/6596)) - Skip DNS lookups on Interactsh domains by @dwisiswant0 ([#6614](https://github.com/projectdiscovery/nuclei/pull/6614)) - Restore parallel processing in file protocol by @dwisiswant0 ([#6493](https://github.com/projectdiscovery/nuclei/pull/6493)) ##### ⚙️ Changed / Improvements - Enable `BenchmarkRunEnumeration/Default` benchmark by @dwisiswant0 ([#6603](https://github.com/projectdiscovery/nuclei/pull/6603)) - Cache Go-rod browser in CI by @dwisiswant0 ([#6640](https://github.com/projectdiscovery/nuclei/pull/6640)) - Apply free-disk-space check on tests by @dwisiswant0 ([#6642](https://github.com/projectdiscovery/nuclei/pull/6642)) - Disable stale workflow for enhancements by @dogancanbakir ([#6637](https://github.com/projectdiscovery/nuclei/pull/6637)) - Omit unnecessary reassignment by @ledigang ([#6622](https://github.com/projectdiscovery/nuclei/pull/6622)) ##### 🧹 Maintenance / Dependencies - Bump the modules group with 6 updates by @dependabot[bot] ([#6615](https://github.com/projectdiscovery/nuclei/pull/6615)) - Bump actions/checkout from 5 to 6 in workflows by @dependabot[bot] ([#6628](https://github.com/projectdiscovery/nuclei/pull/6628)) - Bump PD modules & update `httputil` calls by @dependabot[bot] ([#6629](https://github.com/projectdiscovery/nuclei/pull/6629)) - Bump the modules group with 11 updates by @dependabot[bot] ([#6646](https://github.com/projectdiscovery/nuclei/pull/6646)) - Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] ([#6621](https://github.com/projectdiscovery/nuclei/pull/6621)) - Bump github.com/projectdiscovery/fastdialer@v0.4.16 by @dwisiswant0 ([#6624](https://github.com/projectdiscovery/nuclei/pull/6624)) ##### 🌱 New Contributors - @AuditeMarlow ([#6596](https://github.com/projectdiscovery/nuclei/pull/6596)) - @roiswd ([#6542](https://github.com/projectdiscovery/nuclei/pull/6542)) - @ledigang ([#6622](https://github.com/projectdiscovery/nuclei/pull/6622)) **Full Changelog:** [v3.5.1 → v3.6.0](https://github.com/projectdiscovery/nuclei/compare/v3.5.1...v3.6.0)