nuclei

No entries match these filters. Clear filters

1. v3.11.1 Aug 8, 2026 · release notes

   nuclei v3.11.1 adds DNSSECDNSSECA set of DNS extensions, maintained by the IETF, that add cryptographic signatures to DNS records so resolvers can verify responses have not been tampered with in transit. support, JS-based protocols, -max-time flag, and SDK per-execution callback

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.11.1 https://github.com/projectdiscovery/nuclei.git
   # already have the repo? check out this version:
   $ git checkout v3.11.1

   └──▷ TRY IT
   Limit a scan run to 5 minutes so the process exits gracefully even if targets remain unscanned
   copy

   $ nuclei -u https://example.com -max-time 300

   Write a JS template that queries DNSSEC records (e.g., DS, DNSKEY) which were previously unsupported by the engine
   copy

   $ nuclei -t dnssec-example.yaml

   Process each found result in real-time inside a Go program using the new SDK callback instead of waiting for the scan to finish
   go copy

   engine.ExecuteWithCallback(func(result *sdk.Result) {
     fmt.Println(result.TemplateID)
   })

   • Adds -max-time CLI flag for soft termination of the scan duration
   • Adds dnssec DNS record type support in DNS templates
   • Adds JavaScript clients for HTTP (nuclei/http) and SMBSMBA network file-sharing protocol developed by Microsoft that lets systems share files, printers, and named pipes over a network; cyber tools target or speak it because it is ubiquitous in Windows environments. (nuclei/smb) protocols enabling JS-based templates
   • Adds per-execution result callback to the nuclei SDK engine via WithResultCallback
   • Binds JS template execution to verified content types in templates

   5 details in Everything

2. advisory CVE-2026-76805 Jul 16, 2026 · issue 128
   • CVE-2026-76805: Environment Variable Disclosure via Response-Derived Data in DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces./Fuzz Mode (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
3. advisory CVE-2026-76804 Jul 16, 2026 · issue 128
   • CVE-2026-76804: Local File Read via Workflow File-Protocol Gate Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.5, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
4. advisory CVE-2026-76802 Jul 16, 2026 · issue 128
   • CVE-2026-76802: Arbitrary Command Execution via DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Code Signature Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.7, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. advisory CVE-2026-76819 Jul 16, 2026 · issue 128
   • CVE-2026-76819: Arbitrary Code Execution via Goja JavaScript Engine Vulnerability (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.6, affects >= 3.0.0, < 3.10.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. v3.11.0 Jul 6, 2026 · issue 007

   v3.11.0 requires digital signatures on all custom JavaScript-protocol templates before Nuclei will load them.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.11.0 https://github.com/projectdiscovery/nuclei.git
   # already have the repo? check out this version:
   $ git checkout v3.11.0

   └──▷ TRY IT
   Sign a custom JavaScript-protocol template so it is accepted by Nuclei v3.11.0+ before running it against a target.
   copy

   $ nuclei -sign -t /path/to/your-template.yaml

   • Breaking change: Custom templates using the javascript: protocol must now be digitally signed; unsigned JavaScript templates are skipped at load time and when referenced from workflows.
   • Enforces signature verification for JavaScript templates, extending the code-protocol signing requirement to the JavaScript protocol and its Go-backed runtime modules.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them; unsigned JavaScript templates are skipped during template loading and when referenced from workflows.
7. v3.10.0 Jun 30, 2026 · issue 002

   Nuclei v3.10.0 adds per-host HTTP client pooling for improved scan throughput and connection efficiency.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.10.0 https://github.com/projectdiscovery/nuclei.git
   # already have the repo? check out this version:
   $ git checkout v3.10.0

   • Adds per-host HTTP client pooling, reducing connection overhead and improving parallelism when scanning many distinct hosts.

   1 detail in Everything

8. v3.9.0 Jun 10, 2026 · release notes

   Nuclei v3.9.0 adds impacket integration, Windows RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. helper modules (WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk./TSCH/SCMR/DCOM), and protocol redirect support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.9.0 https://github.com/projectdiscovery/nuclei.git
   # already have the repo? check out this version:
   $ git checkout v3.9.0

   • Supports protocol redirects, allowing templates to follow cross-protocol redirect chains.
   • Adds impacket integration for Windows attack-path testing directly from nuclei templates.
   • New JS helper modules for WMI, Task Scheduler (TSCH), Service Control Manager (SCMR), and DCOM enable Windows RPC enumeration and exploitation in JS-protocol templates.
   • Mirrors -config, -report-config, and -dashboard flags for SDK callers, making programmatic nuclei usage config-consistent with CLI usage.

   4 details in Everything

9. v3.9.0 Jun 10, 2026 · issue 001

   Nuclei v3.9.0 adds protocol redirects, Impacket integration, and Windows RPCRPCRemote Procedure Call, a protocol that lets a program execute a function on another machine as if it were local, giving cyber tools a structured way to communicate across processes or hosts without managing raw sockets. helper modules for JS templates.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v3.9.0 https://github.com/projectdiscovery/nuclei.git
   # already have the repo? check out this version:
   $ git checkout v3.9.0

   • Adds support for protocol redirects, enabling templates to follow cross-protocol redirect chains during scanning.
   • Adds Impacket integration, bringing Windows networking attack primitives into the nuclei engine.
   • Adds WMIWMIWindows Management Instrumentation, Microsoft's built-in framework for querying and controlling Windows system state. Cyber tools use it for remote execution, inventory, and event subscriptions without dropping files to disk., Task Scheduler (tsch), SCMR, and DCOM helper modules for JavaScript templates, enabling Windows RPC-based detections.
   • Adds mirroring of -config, -report-config, and -dashboard flags for SDK callers, closing the gap between CLI and programmatic usage.

   4 details in Everything

10. v3.8.0 Apr 18, 2026 · release notes

    Nuclei v3.8.0 adds XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. context analysis, PDF export, honeypot detection, and service-name port support in network templates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.8.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.8.0

    • Adds XSS reflection context analyzer to the fuzzing engine for more precise cross-site scriptingcross-site scriptingCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection.
    • Adds PDF export option for scan results via the reporting module.
    • Adds honeypot detection to reduce scan noise against honeypot hosts.
    • Supports service names (e.g., http, ssh) in the port field of network templates, removing the need to hard-code port numbers.
    • Supports inline targets and secrets inside template profiles.

    5 details in Everything

11. v3.7.1 Mar 5, 2026 · release notes

    Nuclei v3.7.1 exposes cluster-to-template ID mappings in the API for better programmatic scan introspection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.7.1

    • Exposes cluster IDs mapped to template IDs via the API, enabling programmatic inspection of how templates are clustered during scans.

    1 detail in Everything

12. v3.7.0 Jan 28, 2026 · release notes

    nuclei v3.7.0 adds RSYNC protocol support and a new CDPCDPCisco Discovery Protocol, a Cisco-proprietary Layer 2 protocol that advertises device identity, capabilities, and topology between directly connected Cisco gear, giving cyber tools a passive way to map network infrastructure. WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. endpoint option for headless browser control.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.7.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.7.0

    └──▷ TRY IT
    Connect headless scans to an already-running remote Chrome instance instead of spawning a local browser — useful in containerised or remote-browser setups.
    copy

    $ nuclei -u https://target.example.com -t headless/ -cdp-endpoint ws://127.0.0.1:9222/devtools/browser/<id>

    • Adds cdp-endpoint flag to specify a custom WebSocket endpoint for Chrome DevTools Protocol control in headless mode.
    • Adds RSYNC module, enabling nuclei templates to probe and test RSYNC services.

    2 details in Everything

13. v3.6.2 Dec 31, 2025 · release notes

    nuclei v3.6.2 adds custom Jira OAuth server URL support and TLS session caching for faster connection reuse.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.6.2

    • Supports a custom Jira server URL (site-url) when using OAuth authentication, enabling on-premises Jira integrations.
    • Enables TLS session caching in the client pool to improve connection reuse and reduce handshake overhead.

    2 details in Everything

14. v3.6.0 Dec 4, 2025 · release notes

    nuclei v3.6.0 adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. direct fuzzing, multi-port JS templates, .NET DSL helpers, and a persistent metadata cache.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.6.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.6.0

    • Adds direct fuzzing against a target URL using OpenAPI/Swagger specs, enabling spec-driven fuzz scanning without manual template authoring.
    • Supports multi-port targeting in JavaScript templates, allowing a single JS template to probe multiple ports on a host.
    • Expands the DSL with .NET deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. helper functions for crafting and evaluating deserialization payloads in templates.
    • Adds a persistent metadata cache in the template loader, speeding up repeated template loading across runs.
    • Adds a flag to specify a custom resume file path, giving practitioners control over where scan state is written.

    5 details in Everything

15. v3.5.0 Nov 14, 2025 · release notes

    Nuclei v3.5.0 adds VNC auth, SSH keyboard-interactive, JSON/XPath headless extractors, RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. encryption checks, and Docker execution support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.5.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.5.0

    └──▷ TRY IT
    Set the nuclei templates directory via environment variable instead of a flag — useful in CI pipelines or containerized environments.
    copy

    $ export NUCLEI_TEMPLATES_DIR=/opt/custom-templates
    nuclei -u https://example.com

    • Adds JSON and XPath extractors for headless templates, enabling structured data extraction from browser-rendered pages.
    • Adds VNC authentication support, expanding network protocol coverage for credential-based checks.
    • Adds SSH keyboard-interactive authentication support for SSH-based templates.
    • Adds CheckRDPEncryption function for detecting RDP encryption configurations.
    • Adds vars templating in YAML inputs via ytt (YAML Templating Tool), enabling dynamic parameterization of template inputs.

    +6 more show less

    • Adds text/template syntax support for Jira custom fields in reporting configurations.
    • Enhances MultiPartForm fuzzing with metadata APIs for richer multipart request manipulation.
    • Adds option to control the number of concurrent templates loaded at startup.
    • Adds file metadata fields to parsedTemplate, exposing template file information within template logic.
    • Adds environment variable support for specifying the nuclei templates directory.
    • Adds support for running nuclei inside Docker containers.

    11 details in Everything

16. v3.4.8 Aug 21, 2025 · release notes

    Nuclei v3.4.8 adds concurrent engine support, fuzz variable evaluation, and template-loading performance improvements.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.4.8

    • Supports running concurrent Nuclei engines within the same process, enabling library users to parallelize independent scans.
    • Evaluates variables inside fuzz templates, allowing dynamic payloads to reference template variables at fuzz time.
    • Logs a scan event when a template host is skipped during scanning, improving scan observability.
    • Logs unavailable code-execution engines as errors during template validation, surfacing misconfigured environments earlier.
    • Improves template-loading performance, reducing startup latency for large template sets.

    +1 more show less

    • Enables templates to be used for template listing and display operations.

    6 details in Everything

17. v3.4.5 Jun 17, 2025 · release notes

    nuclei v3.4.5 adds headless response storage for debugging and a new SDK matcher-status configuration option.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.5 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.4.5

    • Stores headless browser responses for post-scan debugging and analysis.
    • Adds EnableMatcherStatus SDK option to configure matcher behavior programmatically.

    2 details in Everything

18. v3.4.3 May 8, 2025 · release notes

    nuclei v3.4.3 adds LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. version detection, MSSQL query execution, and verbose -duc output in JS templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.4.3

    • Adds SupportedLDAPVersion support in JS templates for LDAP protocol interrogation.
    • Adds MSSQL execute-query support in JS templates, enabling active database interaction during scans.
    • Adds verbose output when using -duc (disable update check), surfacing more detail during runs.

    3 details in Everything

19. v3.4.2 Apr 8, 2025 · release notes

    Nuclei v3.4.2 adds bearer tokenbearer tokenA credential that grants access to whoever presents it, without a separate proof of possession. Protecting the token matters because a stolen copy can be used by someone else. authentication support for Jira reporting in self-hosted environments.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.4.2

20. v3.4.0 Mar 26, 2025 · release notes

    nuclei v3.4.0 adds AWS_PROFILE support for S3 template loading via ~/.aws/credentials

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.4.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.4.0

    • Supports AWS_PROFILE environment variable when loading nuclei templates from S3, enabling named credential profiles via ~/.aws/credentials.

    1 detail in Everything

21. v3.3.10 Mar 7, 2025 · release notes

    nuclei v3.3.10 adds CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and PGO profiling capabilities via --profiling-cpu and --profiling-pgo flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.10 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.10

    └──▷ TRY IT
    Capture CPU usage profiles for post-scan analysis using pprof.
    copy

    $ nuclei --target example.com --profiling-cpu profile.cpuprofile

    Generate a PGO binary profile to optimize future runs.
    copy

    $ nuclei --target example.com --profiling-pgo pgo.profile

    • --profiling-cpu <file> enables CPU profiling output to the specified file
    • --profiling-pgo <file> enables PGO profile generation output to the specified file

    2 details in Everything

22. v3.3.9 Feb 13, 2025 · release notes

    nuclei v3.3.9 adds AI-powered on-the-fly template generation, a live DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. Server API, and DSL expressions in headless args.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.9

    └──▷ TRY IT
    Generate and run a custom detection template from plain English without writing YAML — useful for quick, ad-hoc recon during a bug bounty engagement.
    copy

    $ nuclei -list h1.txt -ai "extract page titles"

    Start the experimental Live DAST Server so a proxy or crawler can push requests to nuclei's fuzzer in real time during an active scan session.
    copy

    $ nuclei -dts

    • New -ai flag generates and runs nuclei templates on the fly from natural-language prompts.
    • New -dts flag starts an experimental Live DAST Server API (HTTP) for real-time fuzzing at localhost:9055.
    • Supports DSL expression evaluation inside headless protocol arguments.
    • Adds WithResponseReadSize function for SDK (library) users to control HTTP response read size.

    4 details in Everything

23. v3.3.7 Dec 2, 2024 · release notes

    nuclei v3.3.7 adds OS thread control via env var and a new flag to toggle global matchers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.7

    └──▷ TRY IT
    Limit nuclei to 4 OS threads to reduce CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. contention when running alongside other tools on a shared host.
    copy

    $ OS_MAX_THREADS_ENV=4 nuclei -u https://example.com -t nuclei-templates/

    Opt in to global matchers for a scan where you want cross-template matching logic to apply.
    copy

    $ nuclei -u https://example.com -t nuclei-templates/ -enable-global-matchers

    • New OS_MAX_THREADS_ENV environment variable lets you cap the number of OS threads the Go runtime can use, useful for tuning nuclei's resource footprint on constrained hosts.
    • New -enable-global-matchers flag gives explicit control over whether global matchers execute during a scan.

    2 details in Everything

24. v3.3.6 Nov 21, 2024 · release notes

    nuclei v3.3.6 adds DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. analyzers, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. batch output, and ENV-based dynamic secrets

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.6

    └──▷ USE IT
    Enable batched JSONL output to reduce disk I/O during large scans by buffering 100 records before flushing.
    yaml copy

    # In ~/.config/nuclei/config.yaml or reporter config:
    jsonl:
      file: "results.jsonl"
      omit-raw: false
      batch-size: 100

    • Adds analyzer support and time-based delay analyzer for DAST mode, enabling smarter detection logic during HTTP fuzzing.
    • Adds batch output support for JSONL format via configurable batch-size option in the JSONL exporter config.
    • Supports ENV variable substitution in dynamic secret files, letting secrets be pulled from environment variables or passed via -v/-env-vars flags.
    • Adds SDK functions for setting custom variables and improved nuclei store and workflow access.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -enable-self-contained (or -esc) flag is now required to load self-contained templates; they are no longer enabled by default.
    • !The -file flag must now be explicitly used to enable loading file protocol templates; file templates are no longer loaded by default.
25. v3.3.5 Oct 19, 2024 · release notes

    nuclei v3.3.5 adds global matchers/extractors in HTTP templates, MongoDB reporting, and stop-at-first-match for network templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.5 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.5

    └──▷ TRY IT
    Cap verbose variable dump output to avoid flooding the terminal during large scans
    copy

    $ nuclei -t <template> -u <target> -svd -var-dump-limit 500

    • Adds global matchers/extractors support in HTTP templates, allowing match/extract logic to apply across all requests in a template
    • Adds MongoDB as a results reporting backend for storing scan findings
    • Adds stop-at-first-match support in network templates to halt further requests once a match is found
    • Adds trace file generation when using the -profile-mem option for memory profiling
    • Adds -var-dump-limit flag to control the response character limit when using -svd (show variable dump)

    5 details in Everything

26. v3.3.3 Sep 26, 2024 · release notes

    nuclei v3.3.3 adds Linear issue tracker integration, PDCP dashboard scan upload, and new headless lifecycle events.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.3

    └──▷ TRY IT
    Upload a previously saved nuclei JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. results file to the PDCP cloud dashboard for team review without re-running a scan.
    copy

    $ ./nuclei -pdu nuclei_results.jsonl

    Configure the Linear integration in your nuclei config to auto-create issues only for critical findings, skipping low-severity results.
    yaml copy

    linear:
      api-key: "lin_api_xxxxxxxxxxxx"
      team-id: "TEAM-UUID"
      project-id: "PROJ-UUID"
      duplicate-issue-check: true
      open-state-id: "STATE-UUID"
      deny-list:
        severity: low

    • Adds Linear issue tracker integration, allowing nuclei findings to automatically create issues with severity-based allow/deny filtering, team/project targeting, and duplicate detection.
    • Adds -pdu/-dashboard-upload flag to upload existing nuclei JSONL scan results to the ProjectDiscovery Cloud Platform (PDCP) dashboard for review.
    • Adds five new headless lifecycle events for template authors: waitdom, waitfcp, waitfmp, waitidle, and waitstable.

    3 details in Everything

27. advisory CVE-2024-43405 Sep 4, 2024 · issue 128
    • CVE-2024-43405: Nuclei Template Signature Verification Bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects > 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
28. v3.3.2 Sep 4, 2024 · release notes

    nuclei v3.3.2 adds ActionWaitDialog for headless XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. detection and Jira issue-type/project-id config support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.2

    • Adds ActionWaitDialog action type in the headless protocol to simplify detection of JavaScript dialog-based XSS.
    • Extends Jira integration config to accept issue-type ID and project ID as optional inputs.

    2 details in Everything

29. v3.3.1 Aug 16, 2024 · release notes

    nuclei v3.3.1 adds team workspace uploads, output redaction, per-template auth skipping, and multi-auth-strategy support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.1

    └──▷ TRY IT
    Upload scan results to a specific team workspace instead of your personal account.
    copy

    $ nuclei -u https://example.com -cloud-upload -team-id cqlmoalcm2sc73eut1b0

    • Adds -team-id flag to upload scan results directly to a specific team workspace in the cloud.
    • Adds -redact flag to strip sensitive keys (query params, request headers, body) from output files.
    • Adds skip-secret-file template attribute to disable secret-file auth on a per-template basis.
    • Supports multiple auth strategies per target sourced from a single secret file.
    • Generates matcher-status events for the JavaScript protocol, improving JS template result visibility.

    5 details in Everything

30. advisory CVE-2024-40641 Jul 17, 2024 · issue 128
    • CVE-2024-40641: Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.4, affects > 3.0.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
31. v3.3.0 Jul 17, 2024 · release notes

    Nuclei v3.3.0 adds UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. port checking, CNAMECNAMEA DNS record type that maps one hostname to another as a canonical alias, letting cyber tools track infrastructure by following chains of names to their true origin. enrichment, richer LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. output, and new SDK controls for timeouts and filesystem.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.3.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.3.0

    • Adds isUDPPortOpen goja function to check whether a UDP port is open from JavaScript templates.
    • Adds cname information to HTTP protocol responses when available, enabling CNAME-aware detections.
    • Improves LDAP output with a custom type that returns additional information beyond basic query results.
    • Adds SDK option to disable the update check programmatically.
    • Adds support for supplying fs.FS explicitly via the SDK for custom template filesystems.

    +2 more show less

    • Adds timeouts configuration in types.Options for fine-grained SDK timeout control.
    • Improves template clustering performance, enabling faster large-scale scans.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -dt / -dialer-timeout CLI flag has been removed; timeout is now configured implicitly or via the SDK types.Options.
    • !The -rrt / -response-read-timeout CLI flag has been removed; response read timeout is now configured implicitly or via the SDK types.Options.
32. v3.2.9 Jun 16, 2024 · release notes

    Nuclei v3.2.9 adds part: request fuzzing, -fuzz-aggression, PDCP team upload, and error log timestamps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.9

    • -fuzz-param-frequency CLI argument allows control over the counter for skipping uninteresting parameters during fuzzing
    • -fuzz-aggression CLI option to control fuzz aggression via template
    • -display-fuzz-points option to display fuzzing points for debugging
    • PDCP_TEAM_ID environment variable supports uploading results to a team account instead of personal
    • -ts option adds timestamp to error logs generated with -elog

    5 details in Everything

33. v3.2.7 May 10, 2024 · release notes

    Nuclei v3.2.7 adds -uncover search query support and -scan-name for pdcp uploads

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.7

    • -uncover option now accepts multiple search queries in templates
    • Adds -sname / -scan-name CLI flag to set the scan name during pdcp result upload

    2 details in Everything

34. v3.2.6 May 4, 2024 · release notes

    New -profile, -profile-list, and -tgl flags for template selection and listing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.6

    └──▷ USE IT
    Scan only templates tagged as AWS cloud misconfigurations using the bundled aws-cloud-config profile
    shell copy

    ./nuclei -profile aws-cloud-config -target <target>

    List all available template tags and their popularity to help select relevant templates manually
    shell copy

    ./nuclei -silent -tgl | head -n 10

    • Adds -profile and -profile-list CLI options to run nuclei using pre-defined template profiles such as aws-cloud-config, bugbounty, or pentest
    • Adds -tgl (template-tags-list) flag to output a sorted list of all available template tags with their usage counts

    2 details in Everything

35. v3.2.5 Apr 25, 2024 · release notes

    Nuclei v3.2.5 adds SRVSRVA DNS record type that advertises the hostname and port for a specific service, letting clients discover endpoints without hardcoded addresses. DNS queries, HTTPX network policies, SDK catalog support, and context cancellation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.5 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.5

    • Adds SRV query support to the dns protocol for resolving service discovery records
    • Adds a networkpolicy configuration option for httpx probes to control allowed protocols and hosts
    • Adds support for user-provided catalogs via the Nuclei SDK (user_catalog)
    • Adds context cancellation support to the Nuclei engine, allowing scans to be interrupted programmatically

    4 details in Everything

36. v3.2.4 Apr 8, 2024 · release notes

    Nuclei v3.2.4 adds ASREProastable method in LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. module for new attack vectors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.4

    • Adds ASREProastable detection method to the existing LDAP protocol support.

    1 detail in Everything

37. v3.2.3 Apr 3, 2024 · release notes

    Adds -dast flag and pre-condition template attribute for fuzzing workflows

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.3

    └──▷ USE IT
    Run only fuzzing/DASTDASTDynamic application security testing, probing a running application from the outside for vulnerabilities. It checks behavior exposed through the application's interfaces. templates against a target for unknown vulnerabilities
    shell copy

    nuclei -dast -u https://example.com

    • Adds -dast CLI flag to run exclusively DAST (fuzz) templates
    • Introduces pre-condition attribute support in Code and DAST templates

    2 details in Everything

38. v3.2.0 Mar 13, 2024 · release notes

    Nuclei v3.2.0 adds HTTP fuzzing (-fuzz), authenticated scanning, Gitea reporting, and -payload-concurrency.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.2.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.2.0

    └──▷ TRY IT
    Run a fuzzing scan against a target using a specific template.
    copy

    $ nuclei -u https://example.com -fuzz custom-fuzz-template.yaml

    Increase payload concurrency to speed up scans with high payload counts.
    copy

    $ nuclei -u https://example.com -payload-concurrency 10

    • Adds the -fuzz flag to load and execute fuzzing templates during scans
    • Introduces authenticated scanning capabilities for targeted tests
    • Adds -payload-concurrency option to control parallel payload execution
    • Enables reporting output to Gitea issue trackers
    • Implements transparent memoization via function annotations for performance

    +3 more show less

    • Adds a new JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output format for issue tracker integration along with CLI summary
    • Supports self-contained requests at the individual HTTP request level within templates
    • Enhances the ldap protocol with new capabilities

    8 details in Everything

39. v3.1.10 Feb 2, 2024 · release notes

    Nuclei v3.1.10 expands NetworkConfig SDK options for custom network configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.10 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.10

    • NetworkConfig struct gains additional fields in the Go SDK, enabling finer control over network settings for custom templates and extensions.

    1 detail in Everything

40. v3.1.9 Feb 1, 2024 · release notes

    Adds automatic technology detection with -as flag and passive SDK support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.9

    └──▷ USE IT
    Scan a target and automatically detect technologies without specifying templates manually.
    shell copy

    nuclei -u https://example.com -as

    Use the new user-agent module in a custom nuclei workflow.
    go copy

    import github.com/projectdiscovery/useragent

    • Adds -as flag to enable automatic hybrid technology detection using Wappalyzer and tech templates during scans
    • Adds projectdiscovery/useragent module for user-agent handling
    • Adds passive option support in the SDK

    3 details in Everything

41. v3.1.7 Jan 22, 2024 · release notes

    Nuclei v3.1.7 adds -scan-id to upload results to existing pdpc scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.7

    └──▷ USE IT
    Attach current scan results to a specific PDCP scan for aggregation.
    shell copy

    nuclei -u example.com -cloud-upload -scan-id XXXXXX

42. v3.1.6 Jan 18, 2024 · release notes

    Nuclei v3.1.6 adds GetServiceTicket and GetKerberoastableUsers methods to the kerberos and ldap modules for new attack capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.6

    └──▷ USE IT
    Retrieve a service ticket via the kerberos module.
    go copy

    // Code snippet demonstrating the new method
    kerberos.GetServiceTicket(...)

    Identify kerberoastable users via the ldap module.
    go copy

    // Code snippet demonstrating the new method
    ldap.GetKerberoastableUsers(...)

    • Adds GetServiceTicket method to the kerberos module
    • Adds GetKerberoastableUsers method in ldap module

    2 details in Everything

43. v3.1.4 Jan 8, 2024 · release notes

    nuclei v3.1.4 adds self-contained fuzzing input, -as custom tags, internal matchers, and L4 layer exclusion.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.4

    • self-contained is now supported for input in fuzzing templates, allowing templates to define their own input sources directly.
    • The -as CLI option accepts additional custom tags that are included with scan results.
    • Matchers can now be hidden from flow output by setting internal: true within the matcher definition.
    • Layer 4 scans via fastdialer now support an exclude list to filter out specific targets.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The to attribute in extractor configurations is removed; file write operations in extractors are no longer supported for security reasons.
44. v3.1.3 Dec 21, 2023 · release notes

    Nuclei v3.1.3 adds email support to the SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. client and exposes a new Networkconfig interface in the SDK

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.3

45. v3.1.1 Dec 9, 2023 · release notes

    nuclei v3.1.1 adds arbitrary string input support for TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. annotation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.1

    • tls-sni template annotation now accepts arbitrary string input instead of requiring a DNS name

    1 detail in Everything

46. v3.1.0 Nov 30, 2023 · release notes

    Nuclei v3.1.0 adds PDCP Dashboard integration, SSH command execution in JS templates, JSON output fields, and new filtering options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.1.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.1.0

    └──▷ USE IT
    Scan targets while setting specific dialer timeouts and keep-alive durations for network requests.
    shell copy

    nuclei -u https://example.com -dt 5s -dka 10s

    Include failed matches for hosts that errored during scanning using the new flag.
    shell copy

    nuclei -u https://example.com -ms true

    Write a JavaScript template to execute SSH commands on remote hosts.
    yaml copy

    javascript:
      - args:
          Host: "{{Host}}"
          Port: "22"
        code: |
          var m = require("nuclei/ssh");
          var c = m.SSHClient();
          c.Connect(Host, Port, template.Username, template.Password)
          c.Run("echo lolz > /tmp/lolz");
          var response = c.Run("cat /tmp/lolz");
          c.Close()
          to_json(response);

    • Added -ms CLI flag to include failed matches for errored hosts in scan output
    • Added -dt / -dialer-timeout and -dka / -dialer-keep-alive flags to set network request timeout and keep-alive duration
    • Added host, host:port, ip, ip:port, cidr, and regex patterns to the exclude feature for scan input list filtering
    • Added support for comma-separated ports in network template fields (e.g., port: 22,2222)
    • Added port, scheme, and url fields to JSON/JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output format

    +1 more show less

    • Added SSH command execution capability in JavaScript protocol templates via the nuclei/ssh module

    6 details in Everything

47. v3.0.4 Nov 18, 2023 · release notes

    Nuclei v3.0.4 adds TLS version/cipher enumeration, JSON template output control, cookie reuse defaulting, and pprofiling via env var

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.0.4

    └──▷ USE IT
    Omit the base64 encoded template payload from JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output to reduce noise or size
    shell copy

    ./nuclei -u https://example.com -jsonl -ot

    Enable runtime profiling for performance debugging via environment variable
    shell copy

    PPROF=1 ./nuclei -u https://scanme.sh

    • tls_version_enum and tls_cipher_enum config options added to SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. protocol templates for TLS version and cipher enumeration
    • -ot / -omit-template flag added to exclude base64 encoded templates from JSON/JSONL output
    • Base64 encoding helpers added to the JavaScript protocol for custom templates
    • cookie-reuse enabled as default with disable-cookie: true config key to opt out
    • PPROF=1 environment variable enables pprofiling without changing command flags

    5 details in Everything

48. v3.0.3 Nov 2, 2023 · release notes

    Nuclei v3.0.3 adds self-contained template support to the headless protocol.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.0.3

49. v3.0.0 Oct 19, 2023 · release notes

    Nuclei v3 introduces code templates, JS scripting protocols, template signing, multi-protocol execution, and a library SDK.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v3.0.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v3.0.0

    • Adds support for code type templates, allowing vulnerability logic to be written directly in JavaScript within the template file rather than using YAML-only instructions.
    • Adds template signing and verification capabilities, enabling maintainers to cryptographically sign templates so Nuclei can verify authenticity during execution.
    • Adds multi-protocol execution engine, allowing a single template to chain multiple protocol handlers sequentially or in parallel to perform complex attack workflows.
    • Adds javascript as a supported protocol for scripting within templates, including 15+ standard protocol libraries (e.g., http, dns, tcp) to be used as JS objects.
    • Adds an abstracted SDK, allowing Nuclei to be imported and used programmatically as a library in Go projects rather than just as a standalone CLI binary.

    5 details in Everything

50. v2.9.15 Sep 16, 2023 · release notes

    Nuclei v2.9.15 adds a port field to the network protocol template definition.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.15 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.15

    • Added GH workflow for weekly performance test

    1 detail in Everything

51. v2.9.14 Sep 4, 2023 · release notes

    Nuclei v2.9.14 adds an impact field to template metadata for richer vulnerability context in output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.14 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.14

    • Adds an impact field to the template information block (e.g., in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output) providing a description of exploitation consequences

    1 detail in Everything

52. v2.9.13 Aug 26, 2023 · release notes

    Nuclei v2.9.13 adds public template support via -t, xpath matchers, and headless file read restrictions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.13 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.13

    └──▷ USE IT
    Run a specific public template hosted on the nuclei template store against a target.
    shell copy

    nuclei -t https://templates.nuclei.sh/public/CVE-2023-38035 -u https://example.com

    Define an xpath matcher in a custom template to find script tags with specific attributes.
    yaml copy

    matchers:
      - type: xpath
        part: body
        xpath:
          - "//script[contains(@src,'//') and not(contains(translate(@integrity,'ABCDEFGHIJKLMNOPQRSTUVWXYZ','abcdefghijklmnopqrstuvwxyz'),'^sha'))]"

    View the changelog for the nuclei-templates repository during execution.
    shell copy

    nuclei -u https://example.com -vv

    • Supports running public or shared templates from templates.nuclei.sh via the -t flag
    • Adds xpath as a new matcher type for template definitions
    • Applies file read restriction to the headless protocol, matching other protocols
    • Updates short options -tu and -wu to -turl and -wurl respectively
    • Renders nuclei-templates changelog in CLI output using the -vv option

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The short options -tu and -wu are now -turl and -wurl respectively
53. v2.9.11 Aug 18, 2023 · release notes

    Nuclei v2.9.11 adds request/response data in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. output for failed matches via -ms

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.11 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.11

    • Adds request and response fields to JSONL output when a match fails with the -ms option

    1 detail in Everything

54. advisory CVE-2023-37896 Aug 4, 2023 · issue 128
    • CVE-2023-37896: Nuclei < 2.9.9 - Sandbox restriction bypass (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.9, affects < 2.9.9)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
55. v2.9.10 Jul 28, 2023 · release notes

    nuclei v2.9.10 adds MARKDOWN_EXPORT_SORT_MODE env var, headless-options flag, and wildcard -id filter

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.10 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.10

    • Adds the MARKDOWN_EXPORT_SORT_MODE environment variable to control sorting in markdown exports (template, severity, host)
    • Adds -ho, -headless-options string[] flag to pass additional options to headless Chrome
    • Adds wildcard pattern support to the -id option for filtering templates

    3 details in Everything

56. v2.9.9 Jul 17, 2023 · release notes

    Nuclei v2.9.9 adds JARM calculation, env var template source blocking, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. classification, and strict sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.9

    └──▷ USE IT
    Disable all template updates to prevent internet access during scanning
    shell copy

    export DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD=true
    export DISABLE_NUCLEI_TEMPLATES_GITHUB_DOWNLOAD=true
    nuclei -t templates/ -u target.com

    Calculate JARM hash for a target in a template
    yaml copy

    {{jarm("1.1.1.1:443")}}

    • Adds environment variables DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD, DISABLE_NUCLEI_TEMPLATES_GITHUB_DOWNLOAD, DISABLE_NUCLEI_TEMPLATES_GITLAB_DOWNLOAD, DISABLE_NUCLEI_TEMPLATES_AWS_DOWNLOAD, and DISABLE_NUCLEI_TEMPLATES_AZURE_DOWNLOAD to control template update sources
    • Adds the {{jarm("host:port")}} helper function for JARM hash calculation in templates
    • Adds epss-percentile attribute support in the classification section of templates
    • Introduces -lfa (-allow-local-file-access) and -lna (-restrict-local-network-access) flags to control sandbox behavior, replacing the deprecated -sandbox flag
    • Adds the -or (-omit-raw) option to exclude request/response pairs from JSON, JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory., and Markdown outputs for findings only

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -sandbox flag is removed; use -lfa and -lna instead to control sandbox behavior
    • !Payload loading from arbitrary locations is now disabled by default; use -lfa to allow it if needed
    • !Request/response inclusion in results is now enabled as default; use -or (-omit-raw) to exclude them
57. v2.9.7 Jun 26, 2023 · release notes

    Nuclei v2.9.7 adds ja3 TLS randomization, headless query fuzzing, {{public_ip()}} helper, and header/status matchers for headless templates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.7

    └──▷ USE IT
    Evade TLS fingerprinting on target scanners by randomizing the JA3JA3A method for fingerprinting TLS clients by hashing fields from the ClientHello message, producing a short string that identifies the TLS library or application making a connection regardless of IP or port. hash during scans.
    shell copy

    nuclei -u https://example.com -tlsi

    Fuzz URL query parameters within a headless browser workflow to find injected XSSXSSCross-site scripting, an attack that runs malicious script in another user's browser through a trusted site. It can steal data or perform actions using the user's session. or endpoints.
    copy

    $ # In template YAML
    headless:
      steps:
        - type: action
          args:
            name: goto
            value: '{{baseUrl}}/?id={{fuzzer.query}}'
      fuzzer:
        type: headless
        queries:
          - 'test123', '456test'

    Use the external-facing IP in templates for conditional logic or payload generation.
    copy

    $ # In template YAML
    id: my-template
    info:
      name: Use Public IP
    request:
      raw:
        - |GET /api/check?ip={{public_ip()}} HTTP/1.1Host: {{Hostname}}

    • Adds -tlsi (ja3 client hello randomization) CLI flag for TLS interception traffic manipulation
    • Adds query fuzzing support in the headless protocol via template expressions
    • Adds {{public_ip()}} helper function available in all templates to resolve the public IP
    • Adds header and status matchers for headless protocol detections
    • Adds disable-path-automerge option to raw request templates

    5 details in Everything

58. v2.9.5 May 28, 2023 · release notes

    Nuclei v2.9.5 adds DNS payload support, any type queries, and template constants.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.5 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.5

    • Adds any type query support in the dns protocol
    • Added support for constants in templates
    • Added payloads support in the dns protocol

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed .yml extension support for template input as URL
59. v2.9.4 May 11, 2023 · release notes

    nuclei v2.9.4 adds --reset flag to clear all configuration and templates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.4

    └──▷ TRY IT
    Clean reinstall or environment reset before auditing new target infrastructure
    copy

    $ nuclei --reset

    • --reset command-line flag added to remove all nuclei configuration, data files, and template repositories in one step

    1 detail in Everything

60. v2.9.3 May 3, 2023 · release notes

    New DSL fields for DNS responses, template filtering by classification, mandatory severity enforcement, and extractor output to file.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.3

    • Added support to filter templates based on classification
    • Added check to make severity as a mandatory field
    • Adds the output option to save extractor results to a file

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The severity field is now mandatory in templates
61. v2.9.2 Apr 19, 2023 · release notes

    Nuclei v2.9.2 adds azure blob storage for template downloads and JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. export support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.2

    └──▷ TRY IT
    Export scan results to a JSONL file for downstream ingestion by SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or dashboards.
    copy

    $ nuclei -u https://example.com -json-export results.jsonl

    Configure nuclei to download custom templates from an Azure Blob Storage container.
    yaml copy

    # Requires configuration in ~/.config/nuclei/config.yaml or via -t flag pointing to template set
    # Example config snippet:
    # templates:
    #   - azure://account-name@container-name/path

    • Added llm_prompt as a new DSL helper function to allow dynamic prompt generation in templates
    • Added support for azure blob storage as a source for custom template downloads
    • Added support for gitlab project as a source for custom template downloads
    • Added CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. / EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Score information to the cve-annotation output field
    • Added variable evaluation support within payloads and variables sections of templates

    +1 more show less

    • Added -je (or -json-export) flag to export results in JSONL format

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The short flag for self-update has been renamed from -un to -up
62. v2.9.1 Apr 2, 2023 · release notes

    Nuclei v2.9.1 adds -json-export flag, AWS template catalogs, cpe/epss-score classification, and JIRA custom fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.1

    └──▷ USE IT
    Export raw scan findings to a structured JSON file for downstream processing by other cyber tooling
    shell copy

    nuclei -u https://example.com -json-export results.json

    Write standard output in JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. format for log ingestion or streaming analysis
    shell copy

    nuclei -u https://example.com -jsonl | jq .host

    • Adds -json-export (aliased as -je) flag to export scan results to a JSON file, separate from the new -jsonl output option
    • Adds cpe and epss-score support in template classification for vulnerability prioritization metadata
    • Adds mkdir command support within headless browser screenshot workflows
    • Adds JIRA custom fields support for integration templates
    • Adds AWS S3 bucket catalog loading capability for importing template collections

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -json flag is renamed to -jsonl (or -j) to write output in JSONL format; existing scripts using -json will fail or behave incorrectly.
    • !Template protocol attribute names requests are deprecated in favor of http, and network in favor of tcp; templates using the old names still work but are scheduled for removal.
63. v2.9.0 Mar 16, 2023 · release notes

    Nuclei v2.9.0 adds JSON template support, template signing, new helpers ip_formats() and resolve(), and -track-error flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.9.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.9.0

    • Adds ip_formats() helper function for template writers to validate IP address formats
    • Adds resolve() helper function for template writers to perform DNS resolution during execution
    • Adds -track-error CLI option to add custom errors to the max-host-error watch list
    • Adds CLI option to override fuzzing template options via flag
    • Adds support for templates in JSON format, allowing non-Go template definitions

    +1 more show less

    • Adds template sign/verify functionality to ensure template integrity

    6 details in Everything

64. v2.8.9 Feb 10, 2023 · release notes

    Nuclei v2.8.9 adds environment variable support in reporting config and interacts payload support in TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.9

    • Adds NUCLEI_REPORTING_* environment variable substitution in reporting configuration files
    • Enables interactsh payload input expansion in the tls_sni field for templates

    2 details in Everything

65. v2.8.8 Jan 24, 2023 · release notes

    Nuclei v2.8.8 adds clustering for DNS and TLS templates plus a -no-mhe CLI flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.8

    └──▷ TRY IT
    Run a scan without HTTP/2 multiplexed header enumeration using the new flag.
    copy

    $ nuclei -u https://example.com -no-mhe

    • -no-mhe flag added to disable HTTP/2 multiplexed header enumeration
    • Clustering support added for DNS templates
    • Clustering support added for TLS templates

    3 details in Everything

66. v2.8.7 Jan 15, 2023 · release notes

    Nuclei v2.8.7 adds generate_jwt, json_minify, and json_prettify helper functions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.7

    └──▷ TRY IT
    Generate a JWTJWTAn open standard (RFC 7519) for encoding claims as a signed, optionally encrypted JSON object passed between parties. Cyber tools use it to verify identity and permissions without querying a central session store. in a nuclei template workflow for authenticated requests
    copy

    $ token := generate_jwt(secret, claims)

    Minify JSON data before logging or transmitting in a template
    copy

    $ compact_json := json_minify(data)

    Format JSON output for better readability in logs or reports
    copy

    $ pretty_json := json_prettify(data)

    • Adds generate_jwt helper function for generating JSON Web Tokens
    • Adds json_minify helper function to compact JSON output
    • Adds json_prettify helper function to format JSON with indentation

    3 details in Everything

67. v2.8.6 Jan 5, 2023 · release notes

    nuclei v2.8.6 adds advanced template filtering fields and fixes headless file upload

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.6

    • Advanced Template Filtering: Extended the set of available fields for filtering templates during execution.

    1 detail in Everything

68. v2.8.4 Jan 2, 2023 · release notes

    Nuclei v2.8.4 adds YAML inclusion, Splunk exporter, and stop-at-first-match for headless scans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.4

    • Adds stop-at-first-match flag to the headless protocol for faster scanning
    • Adds splunk exporter for sending reports directly to Splunk
    • Adds YAML inclusion support in templates
    • Adds DNS TLSA record query support

    4 details in Everything

69. v2.8.3 Dec 11, 2022 · release notes

    Nuclei v2.8.3 adds --disable-clustering flag and custom IP variables for protocols

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.3

    └──▷ USE IT
    Force sequential request execution by disabling the default clustering optimization
    shell copy

    nuclei --disable-clustering -u https://example.com

    • Adds the --disable-clustering CLI flag to disable request clustering during execution
    • Adds custom ip values to protocol-generated variables

    2 details in Everything

70. v2.8.0 Dec 5, 2022 · release notes

    Nuclei v2.8.0 adds ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses./CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. and search engine inputs via integrations, query param fuzzing, and new CLI flags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.8.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.8.0

    • attack-type CLI flag to override template attack-type at runtime
    • -sandbox option for sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls. payload files and requests
    • split DSL function in templates
    • ASN/CIDR input support via asnmap integration
    • Search engine query input support via uncover integration

    +4 more show less

    • URL fuzzing for query parameters
    • Automatic HTTP probing based on input (httpx integration)
    • Optional -max-host-error skip behavior for connection refused errors
    • Optional variable dump feature

    9 details in Everything

71. v2.7.8 Oct 7, 2022 · release notes

    nuclei v2.7.8 adds tlsx integration, CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. input support, -ldf flag, and several new DSL functions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.8

    └──▷ USE IT
    Scan a CIDR range directly without pre-resolving IPs.
    shell copy

    nuclei -cidr 192.168.1.0/24

    • Adds tlsx integration to nuclei for TLS/SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. analysis.
    • Adds -cidr CLI argument to accept CIDR ranges as direct input targets.
    • Adds same-host redirect following with -fhr flag in CLI and templates.
    • Adds -ldf CLI flag to list available DSL functions.
    • Adds new DSL functions: to_unix_time, hex_to_dec, oct_to_dec, bin_to_dec, contains_all, contains_any, sort, uniq, and sha512.

    +4 more show less

    • Adds response truncation support via CLI flags.
    • Adds shared context execution in workflows.
    • Adds multiple named matcher based condition support in workflows.
    • Adds elasticsearch host reporting field support.

    9 details in Everything

72. v2.7.7 Aug 26, 2022 · release notes

    Nuclei v2.7.7 adds -tc template filtering, -lha headless display, substr/aes_cbc DSL helpers, and custom config directory support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.7 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.7

    • Adds advanced template filtering via the new -tc flag
    • Adds -lha flag to list headless actions without executing them
    • Adds -config-directory flag to specify a custom configuration path
    • Adds substr and aes_cbc DSL helpers for use in templates
    • Adds reference-based tag addition capability to templates

    +2 more show less

    • Adds xml extraction support to the existing xpath extractor
    • Adds option to specify network interface for outgoing requests

    7 details in Everything

73. v2.7.6 Aug 17, 2022 · release notes

    Nuclei v2.7.6 adds memory profiling CLI flag and new template helper functions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.6

    └──▷ TRY IT
    Profile memory usage during a scan to identify potential leaks or high-consumption areas.
    copy

    $ nuclei -target example.com -profile-mem

    • Adds the profile-mem CLI flag for memory profiling.
    • Adds four new helper functions for templates: starts_with, ends_with, line_starts_with, and line_ends_with.
    • Adds an initial catalog interface implementation.

    3 details in Everything

74. v2.7.5 Jul 24, 2022 · release notes

    Nuclei v2.7.5 adds automatic KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. tagging and payload request flow override annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.5 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.5

    • Adds payload request flow override using annotations to control request execution logic
    • Enables global variables support in the SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. protocol

    2 details in Everything

75. v2.7.4 Jul 18, 2022 · release notes

    New CLI flags for template versioning (-ntv), matcher exclusion (-em), and strict syntax bypass (-nss)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.4

    • Adds -ntv / -new-templates-version CLI flag to run templates by specific versions
    • Adds -em / -exclude-matchers for match-based exclusion logic
    • Adds support for include-templates to override tags based template exclusion
    • Adds template-based request timeout support via annotations
    • Adds unexpected fields validation in matchers

    +4 more show less

    • Adds -nss / -no-strict-syntax flag to disable strict template syntax check
    • Adds interactsh placeholder support for variables in HTTP requests
    • Adds aes_gcm helper function
    • Adds hasstdin helper and -no-stdin flag

    9 details in Everything

76. v2.7.3 Jun 21, 2022 · release notes

    nuclei v2.7.3 adds -health-check diagnostic flag, join and hmac template helpers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.3

    • Adds self-diagnostics subcommand via the -health-check CLI flag to verify environment validity
    • Introduces join and hmac helper functions in the template DSL for custom logic execution

    2 details in Everything

77. v2.7.2 Jun 7, 2022 · release notes

    Nuclei v2.7.2 adds -hm, -sml CLI flags and global variables for headless protocol.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.2

    • Adds optional hang monitor of nuclei engine (-hm, -hang-monitor)
    • Adds matched line display as optional in file templates (-sml, -show-match-line)
    • Adds global variable support to variables for headless protocol
    • Adds custom SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. input support via CLI to unsafe http template

    4 details in Everything

78. v2.7.1 May 17, 2022 · release notes

    Nuclei v2.7.1 adds -sni CLI flag and @tls-sni template variable for custom TLS SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. hostnames

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.1

    └──▷ TRY IT
    Scan a target but force the TLS SNI to a specific hostname different from the domain name.
    copy

    $ nuclei -u https://example.com -sni custom-target.example.com

    Use a custom SNI value inside a YAML template for an HTTP request.
    yaml copy

    requests:
      - raw:
          - |
            @tls-sni:localhost
            GET / HTTP/1.1
            Host: {{interactsh-url}}

    Scan for deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. vulnerabilities using the newly added Urldns gadget.
    copy

    $ nuclei -t path/to/urldns-template.yaml -u https://target.com

    • Adds -sni CLI flag to specify a custom TLS SNI hostname for HTTP requests
    • Adds @tls-sni template variable in HTTP request templates to set the TLS SNI value
    • Adds support for the Urldns gadget from ysoserial

    3 details in Everything

79. v2.7.0 May 8, 2022 · release notes

    nuclei v2.7.0 adds --disable-redirects CLI flag to control HTTP template behavior.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.7.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.7.0

    └──▷ USE IT
    Scan a target using HTTP templates without following redirects, useful for testing endpoint behavior in isolation.
    shell copy

    nuclei -u https://example.com -dr

    • --disable-redirects (shorthand -dr): new CLI flag that disables following redirects for http templates

    1 detail in Everything

80. v2.6.9 Apr 25, 2022 · release notes

    Nuclei v2.6.9 adds template variables, DSL extractors, and raw HTTP annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.6.9

    • Adds variables support to allow generating dynamic values within templates using functions like rand_base and to_lower
    • Adds dsl as a new extractor type for processing response data with Dynamic String List expressions
    • Adds @Host annotation syntax in RAW HTTP templates to override the target host for specific requests

    3 details in Everything

81. v2.6.8 Apr 15, 2022 · release notes

    nuclei v2.6.8 adds digest authentication support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.6.8

    └──▷ USE IT
    Scan a target that requires HTTP Digest Authentication to access the resource.
    shell copy

    nuclei -t templates/ -u https://example.com --digest-auth username:password

    • Added --digest-auth flag to enable HTTP Digest Authentication for template requests

    1 detail in Everything

82. v2.6.6 Apr 11, 2022 · release notes

    nuclei v2.6.6 adds response storage flags, DSL helpers for versions and IPs, and file-based headers/cookies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.6.6

    └──▷ TRY IT
    Save all network traffic for forensic analysis or debugging.
    copy

    $ nuclei -u https://target.com -sresp -srd ./my_logs

    Dynamically generate a unique source IP for each request to bypass rate limits.
    yaml copy

    headers:
      X-Forwarded-For: '{{rand_ip("10.0.0.0/8")}}'

    Verify a server's version is below a known good threshold using DSL.
    yaml copy

    matchers:
      - type: dsl
        dsl:
          - compare_versions(version, '< 5.5.7')

    • Adds -sresp (and -store-resp-dir) CLI flags to store all request/response data to disk.
    • Adds compare_versions(version, '< 5.5.7') DSL helper for version comparison in templates.
    • Adds rand_ip("192.168.0.0/24") DSL helper to generate random IPs within a CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. range.
    • Enables reading custom headers and cookies from files using -H cookies.txt syntax.

    4 details in Everything

83. v2.6.3 Mar 3, 2022 · release notes

    Adds resume, read-all, validate flags; new unknown severity and template metadata custom types.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.6.3

    • Added resume flag for random resume file generation
    • Added read-all attribute to http unsafe request
    • Added interaction event highlighting support in debug mode
    • Added custom type in metadata attribute
    • Added unknown as a new severity option

    +2 more show less

    • Added user-agent customization in headless template
    • Added duplicate template ID check with validate flag

    7 details in Everything

84. v2.6.0 Feb 5, 2022 · release notes

    Nuclei v2.6.0 adds ztls to SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination., remote templates, HEADLESS env vars/payloads, CAA DNS queries, and interactsh filters

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.6.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.6.0

    • ssl protocol now supports optional ztls via the new zcrypto/tls module for SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-less TLS connections
    • headless protocol gains support for environment variables and payloads in templates
    • Add support to run remote hosted templates directly from URLs
    • dns protocol adds CAA DNS query support
    • Interactsh now supports debug-req/debug-resp filters to scope interactions

    5 details in Everything

85. v2.5.9 Jan 23, 2022 · release notes

    Adds global HTTP template variables, concat helper, and debug verb support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.9 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.9

    • Added new global variables for HTTP templates
    • Added concat helper function for template logic
    • Added debug verb support in http base request

    3 details in Everything

86. v2.5.8 Jan 13, 2022 · release notes

    Nuclei v2.5.8 adds ID-based execution, interactsh server pool, AWS signed requests, pause/resume, and .nuclei-ignore path override.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.8

    └──▷ USE IT
    Scan only specific templates by their ID.
    shell copy

    nuclei -t id/eid:1234,5678 -u https://example.com

    • Adds id/eid filter flags for template execution/exclusion by identifier
    • Adds interactsh-server-pool flag to specify a custom interactsh server pool
    • Adds support for LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. search query interactions within interactsh matchers
    • Adds ability to make AWS signed requests via self-contained HTTP templates
    • Adds stop-at-first-match option for interactsh matchers to halt scanning on first hit

    +4 more show less

    • Adds additional variables for interactsh payloads and matchers
    • Adds pause/resume support (-resume) to continue a previous scan session
    • Adds navigation history support for matchers in the headless protocol
    • Adds override of .nuclei-ignore file path when using a custom config file

    9 details in Everything

87. v2.5.4 Dec 9, 2021 · release notes

    Nuclei v2.5.4 adds SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination./Websocket protocol support, new CLI flags for protocol filtering and client cert auth, plus remote template URLs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.4 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.4

    └──▷ USE IT
    Scan a remote template list from GitHub directly without downloading files
    shell copy

    nuclei -tu https://raw.githubusercontent.com/projectdiscovery/nuclei-templates/master/protocols/http/sensitive-data/sensitive-info.yaml
    -l targets.txt

    Filter scanning to only SSL and WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. protocols using the new type filters
    shell copy

    nuclei -t nuclei-templates/ -pt ssl,websocket
    -l targets.txt

    Use client certificate authentication for scanning internal services
    shell copy

    nuclei -t nuclei-templates/ \
      -cc /path/to/client-cert.pem \
      -ck /path/to/client-key.pem \
      -ca /path/to/ca-cert.pem \
      -l targets.txt

    • Adds ssl and websocket protocol types to the scanner core, enabling scans of raw SSL/TLS handshakes and WebSocket endpoints
    • Adds -tu/-template-url and -wu/-workflow-url CLI flags to load template and workflow lists from remote URLs
    • Adds -pt/-type and -ept/-exclude-type flags to filter execution by protocol type (dns, file, http, headless, network, workflow, ssl, websocket)
    • Adds -cc/-client-cert, -ck/-client-key, and -ca/-client-ca flags for client certificate authentication against scanned hosts
    • Adds -ms/-matcher-status flag to show optional matcher failure status in output

    +5 more show less

    • Adds -elog/-error-log flag to write request error logs to a specified file
    • Adds new global variables {{RDN}}, {{DN}}, {{TLD}}, and {{SD}} for DNS templates
    • Adds new global variables {{Host}} and {{Port}} for Network templates
    • Adds new JSON output fields template-url and matcher-status to identify source template URL and matcher status
    • Adds hexadecimal view in debug mode for binary responses

    10 details in Everything

88. v2.5.3 Oct 21, 2021 · release notes

    Nuclei v2.5.3 adds CLI severity filtering (-es), self-contained templates, matcher payloads, and custom resolvers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.3

    └──▷ USE IT
    Exclude low and medium severity templates from a scan using the new filtering flag
    shell copy

    nuclei -u https://example.com -es medium,low

    Pass a wordlist file directly via CLI variable for dynamic payload input in network templates
    shell copy

    nuclei -t network_template.yaml -var wordlist=/path/to/words.txt

    • -es flag allows excluding templates based on severity level during scan execution
    • Self-contained template support for HTTP and Network templates enables bundling dependencies within a single YAML file
    • Matchers now support payload, global variable, and helper functions for dynamic condition evaluation
    • Wordlist input support via CLI variables allows passing external payloads directly from command line
    • Custom resolvers can be specified in DNS templates via dns-resolvers field in template config

    +6 more show less

    • CLI and ENV variable substitution supported in Network templates for dynamic configuration
    • waitvisible method added to headless engine protocol actions for DOMDOMThe browser's in-memory tree representation of a web page's structure, standardized by the W3C, giving cyber tools a programmable interface to read or manipulate page content at runtime. element waiting
    • Interactsh placeholder support in HTTP payloads enables out-of-band detection workflows
    • Unixtime functionality with seconds offset available in template variables for time-based operations
    • Severity labels added to GitHub/GitLab/Jira reporting module output for better triage
    • Coloring applied to matchers when --debug flag is enabled for terminal readability

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !JSON field templateID is renamed to template-id in output
    • !JSON field matcher_name is renamed to matcher-name in output
    • !JSON field extractor_name is renamed to extractor-name in output
    • !JSON field matched is renamed to matched-at in output
    • !JSON field extracted_results is renamed to extracted-results in output
89. v2.5.1 Sep 10, 2021 · release notes

    nuclei v2.5.1 adds self-hosted interactsh token support, base64-raw encoding for deserializationdeserializationTurning stored or transmitted data back into objects a program can use. Unsafe handling of untrusted data can allow unexpected behavior or code execution. helpers, and new template classification/remediation fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.1

    └──▷ USE IT
    Configure a template's deserialization helper to use raw base64 encoding instead of standard Base64.
    yaml copy

    ```yaml
    # Example template snippet
      extractors:
        - type: regex
          part: body
          encoding: base64-raw
          regex:
            - '(.*)'
    ```

    • interactsh-token flag for authenticating with a self-hosted Interact.sh server
    • base64-raw encoding option available in de-serialization helpers for templates

    2 details in Everything

90. v2.5.0 Sep 1, 2021 · release notes

    Nuclei v2.5.0 adds max-host-error, nts flags and Elasticsearch export support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.5.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.5.0

    • Adds Elasticsearch export support in report config
    • Adds max-host-error flag for scan optimization
    • Adds nts flag to disable timestamp in CLI output

    3 details in Everything

91. v2.4.3 Aug 9, 2021 · release notes

    Adds -env-vars, -var, and multiple targets to nuclei v2.4.3

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.3 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.4.3

    └──▷ USE IT
    Inject secrets from the environment directly into a template execution without modifying the YAML.
    shell copy

    nuclei -u https://example.com -env-vars

    Pass dynamic values directly from the CLI for quick testing against multiple hosts.
    shell copy

    nuclei -u http://host1 -u http://host2 -var token=abc

    • Adds -env-vars flag to pass environment variables into templates
    • Adds -var flag for defining CLI variables in templates (e.g., -var A=B)
    • Supports multiple u/target flags for specifying several targets at once

    3 details in Everything

92. v2.4.2 Jul 29, 2021 · release notes

    Nuclei v2.4.2 adds --disable-auto-update flag to control template auto-updates

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.4.2

    └──▷ USE IT
    Run scans in offline or air-gapped environments where automatic template updates would fail or are unwanted.
    shell copy

    nuclei -u https://example.com --disable-auto-update

    • Adds the --disable-auto-update CLI flag to prevent nuclei from automatically updating templates during execution

    1 detail in Everything

93. v2.4.0 Jul 12, 2021 · release notes

    nuclei v2.4.0 adds author/tags filters, workflow support, payload/dynamic extractor for network templates, and JSON stats output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    • -validate flag to validate template syntax before execution
    • -stats-json flag to emit machine-readable statistics in JSON format
    • include-tags and include-templates flags to filter which templates are executed
    • Author-based template filtering via the author field in templates
    • Tags-based subtemplate execution within workflows for conditional logic

    +5 more show less

    • Filter support for workflows to control template selection dynamically
    • Payload support for network requests, enabling dynamic data insertion in network protocol templates
    • Dynamic extractor support for parsing responses from network requests
    • Automatic template install/update functionality
    • Timeout flag support for unsafe templates

    10 details in Everything

94. v2.3.8 Jun 12, 2021 · release notes

    nuclei v2.3.8 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. export, Jira Standalone integration, and http/2 edge case handling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.8 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.3.8

    • Jira Standalone (on-prem) server integration support for issue tracking

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !disk-export (-de) flag is renamed to markdown-export (-me)
95. v2.3.6 May 4, 2021 · release notes

    Nuclei v2.3.6 adds Interactsh integration for detecting blind XXEXXEXML External Entity injection, a class of attack against XML parsers that tricks them into fetching external resources or local files, letting an attacker read sensitive data or trigger server-side request forgery. and SSRFSSRFServer-side request forgery, an attack that tricks a server into making requests chosen by an attacker. Those requests can reach internal services the attacker cannot access directly., plus a new CLI flag for custom host headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.6 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.3.6

96. v2.3.2 Mar 22, 2021 · release notes

    Adds -de reports flag for markdown export to disk in the reporting module

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.2 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.3.2

    └──▷ USE IT
    Export scan results to local Markdown files for easy review or sharing.
    shell copy

    nuclei -u https://example.com -de reports

97. v2.3.1 Mar 13, 2021 · release notes

    New issue-tracker-config file support, exclude-tags/etags flag, and severity with -tags syntax

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.1 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.3.1

    └──▷ USE IT
    Exclude specific templates or tags from a scan using new exclusion flags
    shell copy

    nuclei -tags vulnerability -exclude-tags high

    • Adds issue-tracker-config config file path to enable issue tracker integration configuration
    • Adds exclude-tags and etags CLI flags to filter templates by tags during execution
    • Enables using severity values (e.g., low, high) directly within the -tags argument

    3 details in Everything

98. v2.3.0 Mar 10, 2021 · release notes

    Nuclei v2.3.0 adds headless, TCPTCPA network protocol that delivers a reliable, ordered stream of bytes between two endpoints. It detects lost data and retransmits it., file-based templates, workflows, and Jira/Gitlab integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    └──▷ USE IT
    Run a workflow defined in workflow.yaml using the new -w flag.
    shell copy

    nuclei -w workflow.yaml

    Execute a file-based template directly from disk.
    shell copy

    nuclei -t /path/to/file-template.yaml

    Use custom system resolvers by passing the -r flag to override DNS resolution.
    shell copy

    nuclei -u http://target.com -r /path/to/resolvers.txt

    • headless chrome template engine for rendering JS-heavy pages
    • Network based (TCP) protocol support
    • File based template execution
    • Config file support via -config
    • -w/-workflows flag to run workflow based templates

    +12 more show less

    • Request condition support in templates
    • System resolvers support via -r flag
    • Expressions package support for network protocols
    • Hex encoding support in matchers
    • DNS fallback support
    • Parallelism for workflows
    • Simple JSON based HTTP metrics output
    • Helper functions added to payloads
    • HTTP response redirect chain print and match support
    • Offline HTTP response processing feature
    • Tag based template execution
    • Jira, Github, Gitlab issue tracker integration

    17 details in Everything

99. v2.2.0 Nov 20, 2020 · release notes

    Nuclei v2.2.0 adds HTTP pipeline/fuzzing support, -no-meta/stop-at-first-match flags, .nuclei-ignore, and Burp Collaborator integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.2.0 https://github.com/projectdiscovery/nuclei.git
    # already have the repo? check out this version:
    $ git checkout v2.2.0

    • §variable§ marker for fuzzing templates
    • Added support for Race condition testing
    • Added burp collaborator support
    • Added -trace-log flag to enable trace logging
    • Added -no-meta flag to ignore meta information in output

    +3 more show less

    • Added stop-at-first-match flag to halt on first result
    • Added bulk-size flag for multithreaded request batching
    • Added .nuclei-ignore file support from the current working directory

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !nC flag is renamed to no-color
    • !json-requests flag is renamed to include-rr
    • !pbar flag is renamed to stats
100. v2.1.1 Sep 24, 2020 · release notes

     nuclei v2.1.1 adds severity/exclude/tl flags, .nuclei-ignore, rate limiting, and JSON output for DNS templates

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.1.1 https://github.com/projectdiscovery/nuclei.git
     # already have the repo? check out this version:
     $ git checkout v2.1.1

     └──▷ USE IT
     Scan only high and critical severity templates while excluding cve-2021-44228.
     shell copy

     nuclei -u https://example.com --severity high,critical --exclude cve-2021-44228

     Ignore matches defined in a local ignore file during any scan.
     shell copy

     echo "*" > .nuclei-ignore # Example pattern to ignore all; use specific template IDs or names

     Load custom templates from a local directory alongside standard ones.
     shell copy

     nuclei -u https://example.com -t ./custom-templates/,https://github.com/projectdiscovery/nuclei-templates

     • Adds the --severity flag to filter scans by vulnerability severity levels
     • Adds the --exclude flag to exclude specific templates from a scan
     • Adds the --tl flag (template list) to load templates from a specified file path
     • Adds support for .nuclei-ignore files to globally ignore template matches
     • Adds rate limiting per host to control request throughput

     +2 more show less

     • Enables JSON output format for DNS template executions
     • Supports combining local template directories with the standard nuclei-templates repository

     7 details in Everything

101. v2.1.0 Aug 2, 2020 · release notes

     Nuclei v2.1.0 adds live progress bar, wildcard template input, and dynamic extraction/reuse capabilities

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.1.0 https://github.com/projectdiscovery/nuclei.git
     # already have the repo? check out this version:
     $ git checkout v2.1.0

     └──▷ USE IT
     Run a scan with live progress output against a target using wildcard templates.
     shell copy

     nuclei -u https://target.com -t '*/vulnerabilities/*.yaml' --progress

     Use extracted values from a JSON response in a subsequent request.
     yaml copy

     cat <<'EOF'
     requests:
       - method: GET
         path:
           - "{{BaseURL}}/api/login"
         extractors:
           - type: json
             name: "csrf_token"
             part: body
             group:
               - 1
       - method: POST
         path:
           - "{{BaseURL}}/api/action"
         headers:
           csrf: "{{csrf_token}}"
     EOF

     • Adds a --progress flag to show a progress bar with live results during scan execution.
     • Supports wild-card (*) in the -t/--templates flag for matching multiple templates via patterns.
     • Adds support for key-value pairs in key: value format within extractor definitions to match specific JSON/XML fields.
     • Enables dynamic extraction and reuse, allowing values extracted from responses to be passed as variables in subsequent template requests.

     4 details in Everything

102. v2.0.0 Jul 1, 2020 · release notes

     Nuclei v2.0.0 introduces chained workflows, JSON output, and relative path templates

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v2.0.0 https://github.com/projectdiscovery/nuclei.git
     # already have the repo? check out this version:
     $ git checkout v2.0.0

     └──▷ USE IT
     Easily parse Nuclei results in a CI/CD pipeline using standard JSON tools.
     shell copy

     nuclei -u https://example.com --json > results.json

     Run complex sequences of checks where later templates depend on the success or failure of earlier ones.
     shell copy

     nuclei -t workflows/chain.yaml

     Fetch and update templates automatically from your local installation directory without manual downloads.
     shell copy

     nuclei -ut

     • Adds --json flag to enable JSON formatted output for scan results
     • Adds chained workflow support with conditions for complex scanning logic
     • Adds auto-template fetching and updates from the installed directory
     • Adds relative path support for loading templates

     4 details in Everything

103. v1.1.1 Apr 26, 2020 · release notes

     nuclei v1.1.1 adds DNS requests, binary matcher support, and conditional redirect logic to templates

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v1.1.1 https://github.com/projectdiscovery/nuclei.git
     # already have the repo? check out this version:
     $ git checkout v1.1.1

     • Adds dns request type support to templates for DNS-based detection workflows.
     • Adds binary-matcher template logic to match payloads against raw binary responses rather than text strings.
     • Adds conditional redirect handling in templates via the redirect-condition field, allowing checks on final URL state after HTTP redirects.

     3 details in Everything