# Nuclei v3.8.0

- Product: Nuclei (https://whatsnew.fyi/product/nuclei)
- Vendor: ProjectDiscovery
- Date: 2026-04-18
- Version: v3.8.0
- Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0
- Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.8.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **security** — Respect allow-local-file-access in require for JS templates
- **security** — Only evaluate template-authored expressions to prevent unauthorized code execution
- **added** — Add XSS reflection context analyzer to fuzz module
- **added** — Add PDF export option for scan results
- **added** — Support service names in port field for network templates
- **added** — Add honeypot detection to reduce scan noise
- **added** — Add inline targets and secrets to template profiles
- **fixed** — Respect annotations in unsafe mode for HTTP requests
- **fixed** — Isolate project cache keys by scheme and host
- **fixed** — Propagate unresolved variable markers through encoding functions
- **fixed** — Respect WithOptions rate limit in SDK
- **fixed** — Prevent path mutation across sequential Rebuild calls in fuzz module
- **fixed** — Use actual parameter for frequency deduplication in fuzz module
- **fixed** — Fix concurrent map writes in multipart form parsing for fuzz
- **fixed** — Propagate custom headers to time_delay analyzer follow-up requests
- **fixed** — Fix watchdog and propagate context to all JS library network calls
- **fixed** — Interrupt goja runtime on context cancel
- **fixed** — Fix path handling when merging template and target URLs in WebSocket
- **fixed** — Stop spawning template goroutines in host-spray when host is unresponsive
- **fixed** — Optimize removeTargets to prevent hang on large exclusions

<!-- Release notes generated using configuration in .github/release.yml at main -->

##### What's Changed

###### Security Fixes

- **JS**: Respect `allow-local-file-access` in `require` by @dwisiswant0 (#7332)
  - [CVE-2026-41646 - GHSA-29rg-wmcw-hpf4](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-29rg-wmcw-hpf4)
- **Expressions**: Only evaluate template-authored expressions by @dwisiswant0 (#7221)(#7321)
  - [CVE-2026-41645 - GHSA-jm34-66cf-qpvr](https://github.com/projectdiscovery/nuclei/security/advisories/GHSA-jm34-66cf-qpvr)

###### Bug Fixes

- **HTTP**: Respect `annotations` in `unsafe` mode by @dwisiswant0 (#7044)
- **HTTP**: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043)
- **Expressions**: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033)
- **SDK**: Respect `WithOptions` rate limit by @dwisiswant0 (#7342)
- **Fuzz**: Prevent path mutation across sequential `Rebuild` calls by @promisingcoder (#7253)
- **Fuzz**: Use actual parameter for frequency deduplication by @Godzilla675 (#7037)
- **Fuzz**: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291)
- **Fuzz**: Propagate custom headers to `time_delay` analyzer follow-up requests by @usernametooshort (#7125)
- **JS**: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299)
- **JS**: Interrupt goja runtime on context cancel by @mikhail5555 (#7343)
- **WebSocket**: Fix path handling when merging template & target URLs by @Mzack9999 (#7290)
- **Runner**: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129)
- **Input**: Optimize `removeTargets` to prevent hang on large exclusions by @JawsKim (#6760)
- **Installer**: Prevent unnecessary update checks by @dahezhiquan (#7337)
- **Utils**: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045)
- **Client pool**: Replace global variable with local scoping by @mikhail5555 (#7294)
- Fix `InFlight` map race condition via `Snapshot` method by @n3integration (#7026)
- Fix race condition in `Dynamic.Fetch` and always prefetch secrets by @hussain-alsaibai (#6976)
- Fix nil interface set in `createEphemeralObjects` to prevent panic by @maxwolf8852 (#6944)
- Fix DAST skipping URLs with `part: request` and `mode: multiple` by @dogancanbakir (#7326)
- Fix headless JS loading with `-tlsi` and `addheader`/`setheader` by @dogancanbakir (#7325)
- Fix flow execution with auth by @Mzack9999 (#7298)
- Fix redirect handling by @Mzack9999 (#7286)
- Fix Elastic export by @Mzack9999 (#7287)
- Use `crypto/rand` instead of `math/rand` in JS global functions by @sandiyochristan (#7215)

###### New Features

- **Fuzz**: Add XSS reflection context analyzer by @ZachL111 (#7164)
- **Reporting**: Add PDF export option for scan results by @Gengyscan (#7254)
- **Network templates**: Support service names in port field by @dogancanbakir (#7303)
- Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277)
- Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858)

###### Performance & Improvements

- **Runner**: Fast path for tag listing by @dwisiswant0 (#7143)
- **Runner**: Use `Print` instead for `listAvailableStoreTags` by @dwisiswant0 (#7145)
- **Resume state**: Refactored as cache data by @dwisiswant0 (#7042)
- Capture stderr output by @Mzack9999 (#7292)

###### Tests & CI

- Add fuzz tests by @dwisiswant0 (#7311)
- Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300)
- Refactor native tests by @dwisiswant0 (#7307)
- Add `GITHUB_TOKEN` to workflows for authenticated template updates by @dwisiswant0 (#7119)
- Integrate typos spell checker into CI by @telewin95 (#7158)

###### Documentation

- Update outdated documentation links across all translations by @Pitrat-wav (#7020)

##### New Contributors
* @usernametooshort made the

_[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0]_