# Nuclei v3.11.0

- Product: Nuclei (https://whatsnew.fyi/product/nuclei)
- Vendor: ProjectDiscovery
- Date: 2026-07-06
- Version: v3.11.0
- Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.0
- Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.11.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Require digital signatures for custom templates using the javascript: protocol before they can be loaded or executed

<!-- Release notes generated using configuration in .github/release.yml at main -->

##### What's Changed

###### ⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, **custom templates that use the `javascript:` protocol must be digitally signed** before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

**Why this change**

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in [#7469](https://github.com/projectdiscovery/nuclei/pull/7469)). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

**Who is affected**

| Scenario | Impact |
|----------|--------|
| Default scans using [nuclei-templates](https://github.com/projectdiscovery/nuclei-templates) | **No action needed** - official templates are pre-signed and verified with ProjectDiscovery's public key |
| Custom/private templates using `javascript:` | **Action required** - sign templates before use |
| Templates using only `flow:` (e.g. `flow: http(1)`) without `javascript:` | **No change** |
| Workflows referencing unsigned JavaScript sub-templates | Those sub-templates are skipped |

**What to do**

Sign your custom templates with:

```bash
nuclei -sign -t /path/to/your-template.yaml
```

See the [Template Signing documentation](https://docs.projectdiscovery.io/templates/reference/template-signing) for key generation, verification, and signing templates that reference external JavaScript or code files.

---

###### 🔒 Security

* feat(templates): require signatures for javascript templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7514

###### Other Changes

* bump x/crypto and go-pkcs12 by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7516
* general maintenance and cleanup by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7469

**Full Changelog**: https://github.com/projectdiscovery/nuclei/compare/v3.10.0...v3.11.0