# Nuclei v3.11.1 - Product: Nuclei (https://whatsnew.fyi/product/nuclei) - Vendor: ProjectDiscovery - Date: 2026-08-08 - Version: v3.11.1 - Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.1 - Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.11.1 What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog. Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'. --- - **added** — Improve lua script with args and values - **added** — Add gRPC JavaScript library - **added** — Render element locators before lookup in headless protocol - **added** — Add duration fields to other events in protocols - **added** — Add DNSSEC DNS record types - **added** — Add per-execution result callback for thread-safe engine in SDK - **added** — Add nuclei/http JavaScript client - **changed** — Reuse metadata cache across thread-safe scans - **changed** — Improve MySQL JavaScript fingerprint with native handshake parsing - **changed** — Improve MSSQL JavaScript fingerprint via TDS prelogin - **changed** — Replace Split in loops with more efficient SplitSeq - **changed** — Wire -max-time soft termination via goflags - **changed** — Bind JavaScript execution to verified content in templates - **fixed** — Avoid deprecated ECDSA coordinate access in signer - **fixed** — Guard against negative regex extractor group to avoid index-out-of-range panic - **fixed** — Preserve form parameters with shared prefixes in fuzz protocol - **fixed** — Fix raw HTTP parser panic on single-LF request body - **fixed** — Avoid panic for disabled stats interval in progress - **fixed** — Fix case-insensitive word matcher missing dynamic rendered values - **fixed** — Stop busy-spinning hang monitor ##### What's Changed ###### 🎉 New Features * Improving lua script with args and values by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/6561 ###### 🐞 Bug Fixes * feat(lib): reuse metadata cache across thread-safe scans by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7608 ###### 🔨 Maintenance * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7528 * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7532 * chore(deps): bump crate-ci/typos from 1.47.2 to 1.48.0 in the workflows group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7529 * chore(deps): bump the modules group with 3 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7554 * chore(deps): bump the modules group with 5 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7615 * chore(deps): bump the modules group with 3 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7634 * chore(deps): bump actions/stale from 10 to 11 in the workflows group by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7635 ###### Other Changes * gRPC JavaScript library by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7527 * chore(deps): bump the go_modules group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7533 * fix(signer): avoid deprecated ECDSA coordinate access by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7537 * feat(headless): render element locators before lookup by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7549 * Guard against a negative regex extractor group to avoid an index-out-of-range panic by @arpitjain099 in https://github.com/projectdiscovery/nuclei/pull/7531 * fix(fuzz): preserve form parameters with shared prefixes by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7515 * Fix raw HTTP parser panic on single-LF request body by @zainnadeem786 in https://github.com/projectdiscovery/nuclei/pull/7525 * chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7555 * fix(progress): avoid panic for disabled stats interval by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7557 * Fix case-insensitive `word` matcher missing dynamic (rendered) values by @Synvoya in https://github.com/projectdiscovery/nuclei/pull/7523 * fix: stop busy-spinning hang monitor by @james-yusuke in https://github.com/projectdiscovery/nuclei/pull/7559 * feat(protocols): add duration fields to other events by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7428 * refactor: replace Split in loops with more efficient SplitSeq by @stringsbuilder in https://github.com/projectdiscovery/nuclei/pull/7278 * fix(index): limit include-tags to matching tag exclusions by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7536 * Add DNSSEC DNS record types by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7564 * chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in https://github.com/projectdiscovery/nuclei/pull/7594 * sdk: per-execution result callback for thread-safe engine by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7587 * docs: missing CLI flags in README by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7596 * cli: wire -max-time soft termination via goflags by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7589 * http tlsmeta by @Mzack9999 _[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.1]_