Nuclei v3.10.0

What's Changed

Security Fixes

• Templates: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489)
  • GHSA-qgw5-7j4f-fg97
• JS/MySQL: Gate allowAllFiles behind -lfa by @dogancanbakir (#7473)
  • GHSA-xhmx-w2j4-rw3q
• Templates: Validate code template signatures before DAST loading by @dogancanbakir (#7472)
  • GHSA-jpf4-98qj-qr67
• JS: Update Goja dependency by @Mzack9999 (#7467)
  • GHSA-vxg7-f2jj-jmqm
• Protocols: Enforce template rendering boundary in DAST/fuzz mode by @dwisiswant0 (#7499)
  • GHSA-jpvm-9frm-hjcq

🎉 New Features

• Added per-host HTTP client pooling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7301

🐞 Bug Fixes

• Fixed handling in hosterrorscache to automatically skip hosts that consistently time out by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/7455
• Fixed preservation of explicit target port in network templates (fixes #7323) by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7465
• Fixed connection reuse and improved port pre-flight handling by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6715
• Fixed ASCII-section regex to properly escape literal . by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7476
• Fixed recording of decoded bytes for debug dumps by @snicket2100 in https://github.com/projectdiscovery/nuclei/pull/7478
• Fixed proper escaping of dbname in lib/pq URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7479
• Fixed network policy enforcement prior to LDAP dialing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7494
• Fixed normalization and rejection of trace file DSN options in Oracle by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7480
• Fixed proper escaping of MSSQL database names in connection URLs by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7481
• Fixed krbforge to reject unsandboxed ccache writes by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7482
• Fixed rejection of request-condition(s) during fuzzing by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7466
• Fixed: YAML now correctly rejects recursive include chains by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7492
• Fixed resource leaks by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7502

Other Changes

• Updated govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input by @XananasX7 in https://github.com/projectdiscovery/nuclei/pull/7464
• Updated dependencies to remove unused packages by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7457
• Added fuzzing parser harnesses for raw requests and templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7459

New Contributors

• @XananasX7 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7465
• @snicket2100 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7476

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.9.0...v3.10.0