Skip to content
TrustMyStack, home

nuclei

v3.11.1
projectdiscovery/nuclei

Nuclei is a fast, customizable vulnerability scanner powered by the global security community and built on a simple YAML-based DSL, enabling collaboration to tackle trending vulnerabilities on the internet. It helps you find vulnerabilities in your applications, APIs, networks, DNS, and cloud configurations.

Version of projectdiscovery/nuclei you run

CompareView on GitHub
Maintenance
Active448 commits in 3 months · bus factor 3
License
MITPermissive · OSI-approved
Security
11 advisories4 high, 7 medium · Scorecard 6.4/10
Supported versions
No scheduleendoflife.date does not track this project

32.9k stars · 4k forks · 106 open issues · last release 3 months ago · data checked 4 hours ago

OverviewTourReleasesDocker imagesSecurityLogos

Breaking changes

What to check before upgrading, taken from the notes of the last 30 releases.

  • v3.11.0Jul 6, 2026

    ⚠️ Breaking Change: Signed templates required for JavaScript protocol

    Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

    Why this change

    This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.

    Who is affected

    | Scenario | Impact |

    |----------|--------|

    | Default scans using nuclei-templates | No action needed - official templates are pre-signed and verified with ProjectDiscovery's public key |

    | Custom/private templates using javascript: | Action required - sign templates before use |

    | Templates using only flow: (e.g. flow: http(1)) without javascript: | No change |

    | Workflows referencing unsigned JavaScript sub-templates | Those sub-templates are skipped |

    What to do

    Sign your custom templates with:

    nuclei -sign -t /path/to/your-template.yaml

    See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.

    ---

  • v3.3.6Nov 21, 2024

    ⚠️ Breaking Changes:

    • The -enable-self-contained or -esc flag is now required to load self-contained templates.
    • The -file flag must be used to enable loading file templates.

Release history

All releases on GitHub
Atom feed/feed/projectdiscovery/nuclei
BadgeLatest version of projectdiscovery/nuclei[![version](/badge/projectdiscovery/nuclei)](/p/projectdiscovery/nuclei)

What's Changed

🎉 New Features

🐞 Bug Fixes

🔨 Maintenance

Other Changes

New Contributors

Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.11.0...v3.11.1

Full release notesCompare with previous