# Nuclei v3.9.0

- Product: Nuclei (https://whatsnew.fyi/product/nuclei)
- Vendor: ProjectDiscovery
- Date: 2026-06-10
- Version: v3.9.0
- Original notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0
- Permalink: https://whatsnew.fyi/product/nuclei/releases/v3.9.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Added support for protocol redirects
- **added** — Added impacket integration
- **added** — Added wmi, tsch, scmr, and dcom helper modules for JS
- **added** — Added mirroring of -config, -report-config, and -dashboard flags for SDK callers
- **fixed** — Fixed DNS variables resolving issue
- **fixed** — Fixed expressions to prefer exact placeholders over expressions
- **fixed** — Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned
- **fixed** — Fixed an issue in reporting/jira where status-not was not matched against the transition target status name
- **fixed** — Fixed runner to write unsigned-templates warning (WRN) to stderr
- **fixed** — Fixed InternalEvent access serialization in interactsh
- **fixed** — Fixed workflow to ensure context is properly propagated to child and race steps
- **fixed** — Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64
- **fixed** — Fixed memogen to skip context correctly and auto-push scope to upstream
- **fixed** — Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges
- **fixed** — Fixed SMBv1 probing in JS to occur after SMB2 negotiation
- **fixed** — Fixed templates to reject unknown fields when loading JSON templates
- **fixed** — Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy
- **fixed** — Fixed loader to warn when templates are excluded by .nuclei-ignore tags
- **changed** — Split exact matches and pattern handling in catalog for improved performance
- **removed** — Dropped vulnerable docker/docker dependency

##### What's Changed

###### 🎉 New Features
* Added support for protocol redirects by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7296
* Added impacket integration by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7356
* Added wmi, tsch, scmr, and dcom helper modules for JS by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7388
* Added mirroring of -config, -report-config, and -dashboard flags for SDK callers by @ShubhamRasal in https://github.com/projectdiscovery/nuclei/pull/7393


###### 🐞 Bug Fixes
* Fixed DNS variables resolving issue by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7379
* Fixed expressions to prefer exact placeholders over expressions by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7397
* Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned, by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7378
* Fixed an issue in reporting/jira where status-not was not matched against the transition target status name by @knakul853 in https://github.com/projectdiscovery/nuclei/pull/7361
* Fixed runner to write unsigned-templates warning (WRN) to stderr by @ChrisJr404 in https://github.com/projectdiscovery/nuclei/pull/7371
* Fixed `InternalEvent` access serialization in interactsh by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7322
* Fixed workflow to ensure context is properly propagated to child and race steps by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7383
* Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64 by @ShubhamRasal in https://github.com/projectdiscovery/nuclei/pull/7398
* Fixed memogen to skip context correctly and auto-push scope to upstream by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7419
* Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges by @tejgokani in https://github.com/projectdiscovery/nuclei/pull/7425
* Fixed SMBv1 probing in JS to occur after SMB2 negotiation by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7430
* Fixed templates to reject unknown fields when loading JSON templates by @tejgokani in https://github.com/projectdiscovery/nuclei/pull/7453
* Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy by @akhilesharora in https://github.com/projectdiscovery/nuclei/pull/7410
* Fixed loader to warn when templates are excluded by `.nuclei-ignore` tags by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7452

###### Other Changes
* Splitted exact matches and pattern handling in catalog for improved performance by @mikhail5555 in https://github.com/projectdiscovery/nuclei/pull/7340
* Updated README_PT-BR.md to reflect current project description and features by @gugacyber in https://github.com/projectdiscovery/nuclei/pull/7405
* Fixed broken cloud scanning link by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7413
* Bumped pdsec modules + govaluate/aurora migration by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7414
* Dropped vulnerable docker/docker dependency by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7447
* Used path-aware filesystem containment checks by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7420
* Centralized runtime session handling by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7449


##### New Contributors
* @ChrisJr404 made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7371
* @gugacyber made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7405
* @akhilesharora made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7410
* @tejgokani made their first contribution in https://github.com/projectdiscovery/nuclei/pull/7425

**Ful

_[Truncated at 4000 characters — full notes: https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0]_