What's Changed

🎉 New Features

• Improving lua script with args and values by @Mzack9999 in #6561

🐞 Bug Fixes

• feat(lib): reuse metadata cache across thread-safe scans by @dwisiswant0 in #7608

🔨 Maintenance

• chore(deps): bump the modules group with 5 updates by @dependabot[bot] in #7528
• chore(deps): bump the modules group with 5 updates by @dependabot[bot] in #7532
• chore(deps): bump crate-ci/typos from 1.47.2 to 1.48.0 in the workflows group across 1 directory by @dependabot[bot] in #7529
• chore(deps): bump the modules group with 3 updates by @dependabot[bot] in #7554
• chore(deps): bump the modules group with 5 updates by @dependabot[bot] in #7615
• chore(deps): bump the modules group with 3 updates by @dependabot[bot] in #7634
• chore(deps): bump actions/stale from 10 to 11 in the workflows group by @dependabot[bot] in #7635

Other Changes

• gRPC JavaScript library by @Mzack9999 in #7527
• chore(deps): bump the go_modules group across 1 directory with 2 updates by @dependabot[bot] in #7533
• fix(signer): avoid deprecated ECDSA coordinate access by @dwisiswant0 in #7537
• feat(headless): render element locators before lookup by @dwisiswant0 in #7549
• Guard against a negative regex extractor group to avoid an index-out-of-range panic by @arpitjain099 in #7531
• fix(fuzz): preserve form parameters with shared prefixes by @james-yusuke in #7515
• Fix raw HTTP parser panic on single-LF request body by @zainnadeem786 in #7525
• chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 in the go_modules group across 1 directory by @dependabot[bot] in #7555
• fix(progress): avoid panic for disabled stats interval by @james-yusuke in #7557
• Fix case-insensitive word matcher missing dynamic (rendered) values by @Synvoya in #7523
• fix: stop busy-spinning hang monitor by @james-yusuke in #7559
• feat(protocols): add duration fields to other events by @dwisiswant0 in #7428
• refactor: replace Split in loops with more efficient SplitSeq by @stringsbuilder in #7278
• fix(index): limit include-tags to matching tag exclusions by @dwisiswant0 in #7536
• Add DNSSEC DNS record types by @Mzack9999 in #7564
• chore(deps): bump google.golang.org/grpc from 1.79.3 to 1.82.1 in the go_modules group across 1 directory by @dependabot[bot] in #7594
• sdk: per-execution result callback for thread-safe engine by @Mzack9999 in #7587
• docs: missing CLI flags in README by @Mzack9999 in #7596
• cli: wire -max-time soft termination via goflags by @Mzack9999 in #7589
• http tlsmeta by @Mzack9999 in #7586
• chore(deps): bump github.com/getkin/kin-openapi from 0.132.0 to 0.144.0 in the go_modules group across 1 directory by @dependabot[bot] in #7609
• fix: avoid panic in BuildRequest when request response has no request by @DPS0340 in #7601
• Add CLI runner goroutine leak test by @Mzack9999 in #7582
• Print config directories in -hc and verbose modes by @Mzack9999 in #7578
• extend js smb for #4707 by @Mzack9999 in #7565
• Improve MySQL JS fingerprint with native handshake parsing by @Mzack9999 in #7575
• Improve MSSQL JS fingerprint via TDS prelogin by @Mzack9999 in #7577
• rawhttp bump by @Mzack9999 in #7593
• add nuclei/http js client by @Mzack9999 in #7568
• fix(loader): compile requests during validation by @dwisiswant0 in #7616
• chore(deps): bump modules with known advisories by @dogancanbakir in #7632
• feat(templates): bind js execution to verified content by @dwisiswant0 in #7636
• release prep by @ehsandeep in #7641

New Contributors

• @arpitjain099 made their first contribution in #7531
• @james-yusuke made their first contribution in #7515
• @zainnadeem786 made their first contribution in #7525
• @Synvoya made their first contribution in #7523
• @stringsbuilder made their first contribution in #7278
• @DPS0340 made their first contribution in #7601

Full Changelog: v3.11.0...v3.11.1

What's Changed

⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

Why this change

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

Who is affected

What to do

Sign your custom templates with:

nuclei -sign -t /path/to/your-template.yaml

See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

🔒 Security

• feat(templates): require signatures for javascript templates by @dwisiswant0 in #7514

Other Changes

• bump x/crypto and go-pkcs12 by @dogancanbakir in #7516
• general maintenance and cleanup by @Mzack9999 in #7469

Full Changelog: v3.10.0...v3.11.0

What's Changed

Security Fixes

• Templates: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489)
  • GHSA-qgw5-7j4f-fg97
• JS/MySQL: Gate allowAllFiles behind -lfa by @dogancanbakir (#7473)
  • GHSA-xhmx-w2j4-rw3q
• Templates: Validate code template signatures before DAST loading by @dogancanbakir (#7472)
  • GHSA-jpf4-98qj-qr67
• JS: Update Goja dependency by @Mzack9999 (#7467)
  • GHSA-vxg7-f2jj-jmqm
• Protocols: Enforce template rendering boundary in DAST/fuzz mode by @dwisiswant0 (#7499)
  • GHSA-jpvm-9frm-hjcq

🎉 New Features

• Added per-host HTTP client pooling by @Mzack9999 in #7301

🐞 Bug Fixes

• Fixed handling in hosterrorscache to automatically skip hosts that consistently time out by @knakul853 in #7455
• Fixed preservation of explicit target port in network templates (fixes #7323) by @XananasX7 in #7465
• Fixed connection reuse and improved port pre-flight handling by @Mzack9999 in #6715
• Fixed ASCII-section regex to properly escape literal . by @snicket2100 in #7476
• Fixed recording of decoded bytes for debug dumps by @snicket2100 in #7478
• Fixed proper escaping of dbname in lib/pq URLs by @dwisiswant0 in #7479
• Fixed network policy enforcement prior to LDAP dialing by @dwisiswant0 in #7494
• Fixed normalization and rejection of trace file DSN options in Oracle by @dwisiswant0 in #7480
• Fixed proper escaping of MSSQL database names in connection URLs by @dwisiswant0 in #7481
• Fixed krbforge to reject unsandboxed ccache writes by @dwisiswant0 in #7482
• Fixed rejection of request-condition(s) during fuzzing by @dwisiswant0 in #7466
• Fixed: YAML now correctly rejects recursive include chains by @dwisiswant0 in #7492
• Fixed resource leaks by @Mzack9999 in #7502

Other Changes

• Updated govaluate dependency to prevent slice-bounds panic on invalid UTF-8 input by @XananasX7 in #7464
• Updated dependencies to remove unused packages by @dwisiswant0 in #7457
• Added fuzzing parser harnesses for raw requests and templates by @dwisiswant0 in #7459

New Contributors

• @XananasX7 made their first contribution in #7465
• @snicket2100 made their first contribution in #7476

Full Changelog: v3.9.0...v3.10.0

What's Changed

🎉 New Features

• Added support for protocol redirects by @Mzack9999 in #7296
• Added impacket integration by @Mzack9999 in #7356
• Added wmi, tsch, scmr, and dcom helper modules for JS by @dwisiswant0 in #7388
• Added mirroring of -config, -report-config, and -dashboard flags for SDK callers by @ShubhamRasal in #7393

🐞 Bug Fixes

• Fixed DNS variables resolving issue by @Mzack9999 in #7379
• Fixed expressions to prefer exact placeholders over expressions by @dwisiswant0 in #7397
• Fixed an issue in JS where runtimes that outlive the interrupt grace period are not abandoned, by @Mzack9999 in #7378
• Fixed an issue in reporting/jira where status-not was not matched against the transition target status name by @knakul853 in #7361
• Fixed runner to write unsigned-templates warning (WRN) to stderr by @ChrisJr404 in #7371
• Fixed InternalEvent access serialization in interactsh by @dwisiswant0 in #7322
• Fixed workflow to ensure context is properly propagated to child and race steps by @dwisiswant0 in #7383
• Fixed reporting/gitlab by bumping client-go to v1.9.1 and widening IDs to int64 by @ShubhamRasal in #7398
• Fixed memogen to skip context correctly and auto-push scope to upstream by @Mzack9999 in #7419
• Fixed a slice-bounds panic in telnetmini's ParseNTLMResponse when handling truncated NTLM challenges by @tejgokani in #7425
• Fixed SMBv1 probing in JS to occur after SMB2 negotiation by @dwisiswant0 in #7430
• Fixed templates to reject unknown fields when loading JSON templates by @tejgokani in #7453
• Fixed persistence of QueryAuthStrategy parameters in ApplyAuthStrategy by @akhilesharora in #7410
• Fixed loader to warn when templates are excluded by .nuclei-ignore tags by @dogancanbakir in #7452

Other Changes

• Splitted exact matches and pattern handling in catalog for improved performance by @mikhail5555 in #7340
• Updated README_PT-BR.md to reflect current project description and features by @gugacyber in #7405
• Fixed broken cloud scanning link by @dogancanbakir in #7413
• Bumped pdsec modules + govaluate/aurora migration by @dogancanbakir in #7414
• Dropped vulnerable docker/docker dependency by @dogancanbakir in #7447
• Used path-aware filesystem containment checks by @dwisiswant0 in #7420
• Centralized runtime session handling by @dwisiswant0 in #7449

New Contributors

• @ChrisJr404 made their first contribution in #7371
• @gugacyber made their first contribution in #7405
• @akhilesharora made their first contribution in #7410
• @tejgokani made their first contribution in #7425

Full Changelog: v3.8.0...v3.9.0

What's Changed

Security Fixes

• JS: Respect allow-local-file-access in require by @dwisiswant0 (#7332)
  • CVE-2026-41646 - GHSA-29rg-wmcw-hpf4
• Expressions: Only evaluate template-authored expressions by @dwisiswant0 (#7221)(#7321)
  • CVE-2026-41645 - GHSA-jm34-66cf-qpvr

Bug Fixes

• HTTP: Respect annotations in unsafe mode by @dwisiswant0 (#7044)
• HTTP: Isolate project cache keys by scheme & host by @dwisiswant0 (#7043)
• Expressions: Propagate unresolved variable markers through encoding functions by @dogancanbakir (#7033)
• SDK: Respect WithOptions rate limit by @dwisiswant0 (#7342)
• Fuzz: Prevent path mutation across sequential Rebuild calls by @promisingcoder (#7253)
• Fuzz: Use actual parameter for frequency deduplication by @Godzilla675 (#7037)
• Fuzz: Fix concurrent map writes in multipart form parsing by @Mzack9999 (#7291)
• Fuzz: Propagate custom headers to time_delay analyzer follow-up requests by @usernametooshort (#7125)
• JS: Fix watchdog and propagate context to all JS library network calls by @Mzack9999 (#7299)
• JS: Interrupt goja runtime on context cancel by @mikhail5555 (#7343)
• WebSocket: Fix path handling when merging template & target URLs by @Mzack9999 (#7290)
• Runner: Stop spawning template goroutines in host-spray when host is unresponsive by @usernametooshort (#7129)
• Input: Optimize removeTargets to prevent hang on large exclusions by @JawsKim (#6760)
• Installer: Prevent unnecessary update checks by @dahezhiquan (#7337)
• Utils: Normalize unbracketed IPv6 literals for probing by @dwisiswant0 (#7045)
• Client pool: Replace global variable with local scoping by @mikhail5555 (#7294)
• Fix InFlight map race condition via Snapshot method by @n3integration (#7026)
• Fix race condition in Dynamic.Fetch and always prefetch secrets by @hussain-alsaibai (#6976)
• Fix nil interface set in createEphemeralObjects to prevent panic by @maxwolf8852 (#6944)
• Fix DAST skipping URLs with part: request and mode: multiple by @dogancanbakir (#7326)
• Fix headless JS loading with -tlsi and addheader/setheader by @dogancanbakir (#7325)
• Fix flow execution with auth by @Mzack9999 (#7298)
• Fix redirect handling by @Mzack9999 (#7286)
• Fix Elastic export by @Mzack9999 (#7287)
• Use crypto/rand instead of math/rand in JS global functions by @sandiyochristan (#7215)

New Features

• Fuzz: Add XSS reflection context analyzer by @ZachL111 (#7164)
• Reporting: Add PDF export option for scan results by @Gengyscan (#7254)
• Network templates: Support service names in port field by @dogancanbakir (#7303)
• Add honeypot detection to reduce scan noise by @HarshadaGawas05 (#7277)
• Add inline targets and secrets to template profiles by @SaurabhCodesAI (#6858)

Performance & Improvements

• Runner: Fast path for tag listing by @dwisiswant0 (#7143)
• Runner: Use Print instead for listAvailableStoreTags by @dwisiswant0 (#7145)
• Resume state: Refactored as cache data by @dwisiswant0 (#7042)
• Capture stderr output by @Mzack9999 (#7292)

Tests & CI

• Add fuzz tests by @dwisiswant0 (#7311)
• Add request condition tests for multi-raw-request flow templates by @Mzack9999 (#7300)
• Refactor native tests by @dwisiswant0 (#7307)
• Add GITHUB_TOKEN to workflows for authenticated template updates by @dwisiswant0 (#7119)
• Integrate typos spell checker into CI by @telewin95 (#7158)

Documentation

• Update outdated documentation links across all translations by @Pitrat-wav (#7020)

New Contributors

• @usernametooshort made their first contribution in #7129
• @Pitrat-wav made their first contribution in #7020
• @n3integration made their first contribution in #7026
• @JawsKim made their first contribution in #6760
• @sandiyochristan made their first contribution in #7215
• @telewin95 made their first contribution in #7158
• @Gengyscan made their first contribution in #7254
• @hussain-alsaibai made their first contribution in #6976
• @promisingcoder made their first contribution in #7253
• @Godzilla675 made their first contribution in #7037
• @SaurabhCodesAI made their first contribution in #6858
• @ZachL111 made their first contribution in #7164
• @HarshadaGawas05 made their first contribution in #7277
• @mikelolasagasti made their first contribution in #7282
• @maxwolf8852 made their first contribution in #6944
• @mikhail5555 made their first contribution in #7294
• @dahezhiquan made their first contribution in #7337

Full Changelog: v3.7.1...v3.8.0

What's Changed

🐞 Bug Fixes

• Fixed panic by replacing it with error handling in template loader (#6674) by @umer12-12 in #7090
• Fixed cluster failure handling by @bf-rbrown in #6843
• Fixed by avoiding cross-test chrome teardown races in headless by @dwisiswant0 in #7053
• Fixed data race in evaluateVarsWithInteractsh by @yusei-wy in #6828
• Fixed panic by replacing it with error handling in template loader by @bimakw in #6825

Other Changes

• Added memogen workflow by @dwisiswant0 in #6736
• Removed double parsing in template loading by @dwisiswant0 in #6796
• Bumped github.com/bytedance/sonic to 1.15.0 for Go 1.26 support by @stefanb in #6841
• Improved API by exposing cluster ids mapping to template ids by @yaron12n in #6788

New Contributors

• @yusei-wy made their first contribution in #6828
• @yaron12n made their first contribution in #6788
• @bimakw made their first contribution in #6825
• @umer12-12 made their first contribution in #7090

Full Changelog: v3.7.0...v3.7.1

What's Changed

🎉 New Features

• Added cdp-endpoint option to allow users to specify a WebSocket endpoint for control in headless mode by @dwisiswant0 in #5786
• Added RSYNC module by @Mzack9999 in #6410

🐞 Bug Fixes

• Fixed resume file path condition by @dogancanbakir in #6784
• Fixed race condition regression by @dwisiswant0 in #6748
• Fixed duplicate log spam for permanent errors by @dwisiswant0 in #6697
• Fixed ExecutionId initialization in DefaultOptions function by @dogancanbakir in #6598
• Fixed handling full URLs in unsafe raw requests by @dwisiswant0 in #6589
• Fixed segfault in workflow parsing with global-matchers templates by @dwisiswant0 in #6774
• Fixed logging update summary table to stderr by @ayuxsec in #6769
• Fixed sanitizing host when target has host port by @knakul853 in #6759
• Fixed interactsh matching with payloads by @dwisiswant0 in #6778
• Fixed passing template variables to TCP inputs pre-compilation by @dogancanbakir in #6776

Other Changes

• Replaced seh-msft/burpxml with utils package by @dogancanbakir in #6763
• Removed genproto replace directives from go.mod by @ehsandeep in #6608
• Improved telnet login and added crypto by @Mzack9999 in #6419
• Added Turkish README and enhanced CONTRIBUTING.md by @bahattinyunus in #6740
• Refactored WithNetworkConfig and WithInteractshOptions to be used by NewThreadSafeNucleiEngineCtx by @meme-lord in #5972
• Improved cache template signature verification performance by @dwisiswant0 in #6779

New Contributors

• @bahattinyunus made their first contribution in #6740
• @promalert made their first contribution in #6756
• @ayuxsec made their first contribution in #6769

Full Changelog: v3.6.2...v3.7.0

What's Changed

✨ New Features

• Enabled TLS session caching in the client pool to improve connection reuse and reduce handshake overhead (internal) by @dwisiswant0 in #6713
• Added support for providing a custom Jira server URL (site-url) when using OAuth authentication by @Ice3man543 in #6716

🐞 Bug Fixes

• Improved duplicate issue detection by properly paginating Gitea issue searches by @leonjza in #6707
• Restored JavaScript template execution when the Port argument is not provided by @dwisiswant0 in #6709
• Added pagination support when searching for duplicate issues in GitLab by @dwisiswant0 in #6712
• Corrected an incorrect PostgreSQL execution call signature in the JavaScript engine by @Mzack9999 in #6731
• Fixed a MySQL panic caused by a missing executionId in the execution context by @dwisiswant0 in #6735
• Fixed a segmentation fault in flow execution related to hasMatchers by @dwisiswant0 in #6739

⚡ Performance Improvements

• Optimized the MergeMaps generator to reduce memory allocations by @dwisiswant0 in #6718

🔧 Maintenance

• Updated projectdiscovery/utils to v0.8.0 to fix a deadlock in httputil.ResponseChain by @dwisiswant0 in #6723
• Introduced a PowerShell integration test to improve cross-platform test coverage by @Mzack9999 in #6724
• Updated multiple Go module dependencies across two dependency refreshes by @dependabot[bot] in #6729 & #6741

Other Changes

• Updated issue and pull request templates by @dwisiswant0 in #6673
• Refactored CI workflows by @dwisiswant0 in #6728, this includes:
  • Shipping binaries with Green Tea GC enabled via GOEXPERIMENT
  • Shipping binaries built with profile-guided optimization (PGO)
  • Fixing an auto-merge workflow that never triggered
• Switched release tests to use a stable Go version by @dwisiswant0 in #6737
• Upgraded actions/download-artifact from v6 to v7 in GitHub workflows by @dependabot[bot] in #6742
• Updated compatibility checks to use a stable Go version by @dwisiswant0 in #6743

Full Changelog: v3.6.1...v3.6.2

What’s Changed

🐞 Bug Fixes

• fix(config): template exclusion logic for paths with reserved names by @dwisiswant0 in #6663
• fix(http): lost request body on retries & redirects by @dwisiswant0 in #6666
• fix(http): pass dynamicValues to EvaluateWithInteractsh by @dwisiswant0 in #6685
• fix(lib): segfault when initializing the engine with EnableHeadlessWithOpts by @dwisiswant0 in #6602
• build: fix compilation on loong64 architecture by @dwisiswant0 in #6667
• fix: enable all template types for template list and display by @dwisiswant0 in #6668
• fix(http): cache response strings to reduce memory allocations by @dwisiswant0 in #6679
• fix: body loss on retries/redirects in remaining paths by @dwisiswant0 in #6693
• fix(headless): data race when reading page history by @dwisiswant0 in #6687
• fix(update): handle empty folder edge case during template updates by @Mzack9999 in #6573

🔨 Maintenance

• chore: run goimports to format the codebase by @stringscut in #6691
• chore(deps): bump fastdialer to v0.4.20 to fix >10s delays by @dwisiswant0 in #6688
• chore(deps): bump Go modules (10 updates) by @dependabot[bot] in #6675
• chore(deps): bump Go modules (7 updates) by @dependabot[bot] in #6698
• chore(deps): bump GitHub workflows (2 updates) by @dependabot[bot] in #6699

📚 Documentation

• docs: fix typos in multiple files by @didier-durand in #6653
• docs: fix additional typos across various files by @didier-durand in #6661
• docs: typos and minor improvements by @AaryanBansal-dev in #6669

New Contributors

• @didier-durand made their first contribution in #6653
• @AaryanBansal-dev made their first contribution in #6669
• @stringscut made their first contribution in #6691

Full Changelog: v3.6.0...v3.6.1

What's Changed

✨ New Features

• Write resume file specified by flag by @circleous (#6616)
• Javascript Multi-Port Support by @pussycat0x (#6501)
• Direct fuzzing using target URL for OpenAPI/Swagger by @roiswd (#6542)
• Bump DSL with .NET deserialization helpers by @Ice3man543 (#6625)
• Implement persistent metadata cache in loader by @dwisiswant0 (#6630)
• Check for undefined params for lazy evaluation in variables by @dwisiswant0 (#6618)

🐛 Fixed

• Configure tmpDir for SDK by @AuditeMarlow (#6596)
• Skip DNS lookups on Interactsh domains by @dwisiswant0 (#6614)
• Restore parallel processing in file protocol by @dwisiswant0 (#6493)

⚙️ Changed / Improvements

• Enable BenchmarkRunEnumeration/Default benchmark by @dwisiswant0 (#6603)
• Cache Go-rod browser in CI by @dwisiswant0 (#6640)
• Apply free-disk-space check on tests by @dwisiswant0 (#6642)
• Disable stale workflow for enhancements by @dogancanbakir (#6637)
• Omit unnecessary reassignment by @ledigang (#6622)

🧹 Maintenance / Dependencies

• Bump the modules group with 6 updates by @dependabot[bot] (#6615)
• Bump actions/checkout from 5 to 6 in workflows by @dependabot[bot] (#6628)
• Bump PD modules & update httputil calls by @dependabot[bot] (#6629)
• Bump the modules group with 11 updates by @dependabot[bot] (#6646)
• Bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] (#6621)
• Bump github.com/projectdiscovery/fastdialer@v0.4.16 by @dwisiswant0 (#6624)

🌱 New Contributors

• @AuditeMarlow (#6596)
• @roiswd (#6542)
• @ledigang (#6622)

Full Changelog: v3.5.1 → v3.6.0