https://cybertoolchain.io/tools/nuclei New releases and features in nuclei, tracked by The Cyber Toolchain. en Mon, 06 Jul 2026 07:00:13 GMT https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.11.0 Mon, 06 Jul 2026 07:00:13 GMT v3.11.0 requires digital signatures on all custom JavaScript-protocol templates before Nuclei will load them. • Breaking change: Custom templates using the `javascript:` protocol must now be digitally signed; unsigned JavaScript templates are skipped at load time and when referenced from workflows. • Enforces signature verification for JavaScript templates, extending the code-protocol signing requirement to the JavaScript protocol and its Go-backed runtime modules. Breaking changes: • Custom templates that use the `javascript:` protocol must be digitally signed before Nuclei will load or execute them; unsigned JavaScript templates are skipped during template loading and when referenced from workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.10.0 Tue, 30 Jun 2026 11:21:58 GMT Nuclei v3.10.0 adds per-host HTTP client pooling for improved scan throughput and connection efficiency. • Adds per-host HTTP client pooling, reducing connection overhead and improving parallelism when scanning many distinct hosts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0 Wed, 10 Jun 2026 10:17:31 GMT Nuclei v3.9.0 adds impacket integration, Windows RPC helper modules (WMI/TSCH/SCMR/DCOM), and protocol redirect support. • Supports protocol redirects, allowing templates to follow cross-protocol redirect chains. • Adds impacket integration for Windows attack-path testing directly from nuclei templates. • New JS helper modules for WMI, Task Scheduler (TSCH), Service Control Manager (SCMR), and DCOM enable Windows RPC enumeration and exploitation in JS-protocol templates. • Mirrors `-config`, `-report-config`, and `-dashboard` flags for SDK callers, making programmatic nuclei usage config-consistent with CLI usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.9.0 Wed, 10 Jun 2026 10:17:31 GMT Nuclei v3.9.0 adds protocol redirects, Impacket integration, and Windows RPC helper modules for JS templates. • Adds support for protocol redirects, enabling templates to follow cross-protocol redirect chains during scanning. • Adds Impacket integration, bringing Windows networking attack primitives into the nuclei engine. • Adds WMI, Task Scheduler (tsch), SCMR, and DCOM helper modules for JavaScript templates, enabling Windows RPC-based detections. • Adds mirroring of -config, -report-config, and -dashboard flags for SDK callers, closing the gap between CLI and programmatic usage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.8.0 Sat, 18 Apr 2026 01:47:59 GMT Nuclei v3.8.0 adds XSS context analysis, PDF export, honeypot detection, and service-name port support in network templates. • Adds XSS reflection context analyzer to the fuzzing engine for more precise cross-site scripting detection. • Adds PDF export option for scan results via the reporting module. • Adds honeypot detection to reduce scan noise against honeypot hosts. • Supports service names (e.g., `http`, `ssh`) in the `port` field of network templates, removing the need to hard-code port numbers. • Supports inline targets and secrets inside template profiles. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.1 https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.1 Thu, 05 Mar 2026 11:00:12 GMT Nuclei v3.7.1 exposes cluster-to-template ID mappings in the API for better programmatic scan introspection. • Exposes cluster IDs mapped to template IDs via the API, enabling programmatic inspection of how templates are clustered during scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.7.0 Wed, 28 Jan 2026 09:52:51 GMT nuclei v3.7.0 adds RSYNC protocol support and a new CDP WebSocket endpoint option for headless browser control. • Adds `cdp-endpoint` flag to specify a custom WebSocket endpoint for Chrome DevTools Protocol control in headless mode. • Adds RSYNC module, enabling nuclei templates to probe and test RSYNC services. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.2 https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.2 Wed, 31 Dec 2025 16:33:39 GMT nuclei v3.6.2 adds custom Jira OAuth server URL support and TLS session caching for faster connection reuse. • Supports a custom Jira server URL (`site-url`) when using OAuth authentication, enabling on-premises Jira integrations. • Enables TLS session caching in the client pool to improve connection reuse and reduce handshake overhead. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.6.0 Thu, 04 Dec 2025 20:40:33 GMT nuclei v3.6.0 adds OpenAPI direct fuzzing, multi-port JS templates, .NET DSL helpers, and a persistent metadata cache. • Adds direct fuzzing against a target URL using OpenAPI/Swagger specs, enabling spec-driven fuzz scanning without manual template authoring. • Supports multi-port targeting in JavaScript templates, allowing a single JS template to probe multiple ports on a host. • Expands the DSL with .NET deserialization helper functions for crafting and evaluating deserialization payloads in templates. • Adds a persistent metadata cache in the template loader, speeding up repeated template loading across runs. • Adds a flag to specify a custom resume file path, giving practitioners control over where scan state is written. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.5.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.5.0 Fri, 14 Nov 2025 16:46:47 GMT Nuclei v3.5.0 adds VNC auth, SSH keyboard-interactive, JSON/XPath headless extractors, RDP encryption checks, and Docker execution support. • Adds JSON and XPath extractors for headless templates, enabling structured data extraction from browser-rendered pages. • Adds VNC authentication support, expanding network protocol coverage for credential-based checks. • Adds SSH keyboard-interactive authentication support for SSH-based templates. • Adds `CheckRDPEncryption` function for detecting RDP encryption configurations. • Adds vars templating in YAML inputs via ytt (YAML Templating Tool), enabling dynamic parameterization of template inputs. • Adds `text/template` syntax support for Jira custom fields in reporting configurations. • Enhances `MultiPartForm` fuzzing with metadata APIs for richer multipart request manipulation. • Adds option to control the number of concurrent templates loaded at startup. • Adds file metadata fields to `parsedTemplate`, exposing template file information within template logic. • Adds environment variable support for specifying the nuclei templates directory. • Adds support for running nuclei inside Docker containers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.8 https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.8 Thu, 21 Aug 2025 20:34:48 GMT Nuclei v3.4.8 adds concurrent engine support, fuzz variable evaluation, and template-loading performance improvements. • Supports running concurrent Nuclei engines within the same process, enabling library users to parallelize independent scans. • Evaluates variables inside fuzz templates, allowing dynamic payloads to reference template variables at fuzz time. • Logs a scan event when a template host is skipped during scanning, improving scan observability. • Logs unavailable code-execution engines as errors during template validation, surfacing misconfigured environments earlier. • Improves template-loading performance, reducing startup latency for large template sets. • Enables templates to be used for template listing and display operations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.5 https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.5 Tue, 17 Jun 2025 00:00:19 GMT nuclei v3.4.5 adds headless response storage for debugging and a new SDK matcher-status configuration option. • Stores headless browser responses for post-scan debugging and analysis. • Adds `EnableMatcherStatus` SDK option to configure matcher behavior programmatically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.3 https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.3 Thu, 08 May 2025 13:43:46 GMT nuclei v3.4.3 adds LDAP version detection, MSSQL query execution, and verbose -duc output in JS templates • Adds `SupportedLDAPVersion` support in JS templates for LDAP protocol interrogation. • Adds MSSQL execute-query support in JS templates, enabling active database interaction during scans. • Adds verbose output when using `-duc` (disable update check), surfacing more detail during runs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.2 https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.2 Tue, 08 Apr 2025 09:48:02 GMT Nuclei v3.4.2 adds bearer token authentication support for Jira reporting in self-hosted environments. • Adds bearer token authentication support to Jira reporting integration for self-hosted Jira environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.4.0 Wed, 26 Mar 2025 19:50:40 GMT nuclei v3.4.0 adds AWS_PROFILE support for S3 template loading via ~/.aws/credentials • Supports AWS_PROFILE environment variable when loading nuclei templates from S3, enabling named credential profiles via ~/.aws/credentials. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.9 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.9 Thu, 13 Feb 2025 13:30:49 GMT nuclei v3.3.9 adds AI-powered on-the-fly template generation, a live DAST Server API, and DSL expressions in headless args. • New `-ai` flag generates and runs nuclei templates on the fly from natural-language prompts. • New `-dts` flag starts an experimental Live DAST Server API (HTTP) for real-time fuzzing at `localhost:9055`. • Supports DSL expression evaluation inside headless protocol arguments. • Adds `WithResponseReadSize` function for SDK (library) users to control HTTP response read size. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.7 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.7 Mon, 02 Dec 2024 12:14:59 GMT nuclei v3.3.7 adds OS thread control via env var and a new flag to toggle global matchers • New `OS_MAX_THREADS_ENV` environment variable lets you cap the number of OS threads the Go runtime can use, useful for tuning nuclei's resource footprint on constrained hosts. • New `-enable-global-matchers` flag gives explicit control over whether global matchers execute during a scan. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.6 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.6 Thu, 21 Nov 2024 18:54:58 GMT nuclei v3.3.6 adds DAST analyzers, JSONL batch output, and ENV-based dynamic secrets • Adds analyzer support and time-based delay analyzer for DAST mode, enabling smarter detection logic during HTTP fuzzing. • Adds batch output support for JSONL format via configurable `batch-size` option in the JSONL exporter config. • Supports ENV variable substitution in dynamic secret files, letting secrets be pulled from environment variables or passed via `-v`/`-env-vars` flags. • Adds SDK functions for setting custom variables and improved nuclei store and workflow access. Breaking changes: • The `-enable-self-contained` (or `-esc`) flag is now required to load self-contained templates; they are no longer enabled by default. • The `-file` flag must now be explicitly used to enable loading file protocol templates; file templates are no longer loaded by default. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.5 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.5 Sat, 19 Oct 2024 12:37:44 GMT nuclei v3.3.5 adds global matchers/extractors in HTTP templates, MongoDB reporting, and stop-at-first-match for network templates • Adds global matchers/extractors support in HTTP templates, allowing match/extract logic to apply across all requests in a template • Adds MongoDB as a results reporting backend for storing scan findings • Adds `stop-at-first-match` support in network templates to halt further requests once a match is found • Adds trace file generation when using the `-profile-mem` option for memory profiling • Adds `-var-dump-limit` flag to control the response character limit when using `-svd` (show variable dump) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.3 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.3 Thu, 26 Sep 2024 08:37:53 GMT nuclei v3.3.3 adds Linear issue tracker integration, PDCP dashboard scan upload, and new headless lifecycle events. • Adds Linear issue tracker integration, allowing nuclei findings to automatically create issues with severity-based allow/deny filtering, team/project targeting, and duplicate detection. • Adds `-pdu`/`-dashboard-upload` flag to upload existing nuclei JSONL scan results to the ProjectDiscovery Cloud Platform (PDCP) dashboard for review. • Adds five new headless lifecycle events for template authors: `waitdom`, `waitfcp`, `waitfmp`, `waitidle`, and `waitstable`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.2 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.2 Wed, 04 Sep 2024 14:19:08 GMT nuclei v3.3.2 adds ActionWaitDialog for headless XSS detection and Jira issue-type/project-id config support. • Adds `ActionWaitDialog` action type in the headless protocol to simplify detection of JavaScript dialog-based XSS. • Extends Jira integration config to accept issue-type ID and project ID as optional inputs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.1 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.1 Fri, 16 Aug 2024 15:17:03 GMT nuclei v3.3.1 adds team workspace uploads, output redaction, per-template auth skipping, and multi-auth-strategy support. • Adds `-team-id` flag to upload scan results directly to a specific team workspace in the cloud. • Adds `-redact` flag to strip sensitive keys (query params, request headers, body) from output files. • Adds `skip-secret-file` template attribute to disable secret-file auth on a per-template basis. • Supports multiple auth strategies per target sourced from a single secret file. • Generates matcher-status events for the JavaScript protocol, improving JS template result visibility. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.3.0 Wed, 17 Jul 2024 14:26:28 GMT Nuclei v3.3.0 adds UDP port checking, CNAME enrichment, richer LDAP output, and new SDK controls for timeouts and filesystem. • Adds `isUDPPortOpen` goja function to check whether a UDP port is open from JavaScript templates. • Adds `cname` information to HTTP protocol responses when available, enabling CNAME-aware detections. • Improves LDAP output with a custom type that returns additional information beyond basic query results. • Adds SDK option to disable the update check programmatically. • Adds support for supplying `fs.FS` explicitly via the SDK for custom template filesystems. • Adds timeouts configuration in `types.Options` for fine-grained SDK timeout control. • Improves template clustering performance, enabling faster large-scale scans. Breaking changes: • The `-dt` / `-dialer-timeout` CLI flag has been removed; timeout is now configured implicitly or via the SDK `types.Options`. • The `-rrt` / `-response-read-timeout` CLI flag has been removed; response read timeout is now configured implicitly or via the SDK `types.Options`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.9 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.9 Sun, 16 Jun 2024 14:53:37 GMT Nuclei v3.2.9 adds `part: request` fuzzing, `-fuzz-aggression`, PDCP team upload, and error log timestamps. • `-fuzz-param-frequency` CLI argument allows control over the counter for skipping uninteresting parameters during fuzzing • `-fuzz-aggression` CLI option to control fuzz aggression via template • `-display-fuzz-points` option to display fuzzing points for debugging • `PDCP_TEAM_ID` environment variable supports uploading results to a team account instead of personal • `-ts` option adds timestamp to error logs generated with `-elog` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.7 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.7 Fri, 10 May 2024 19:35:39 GMT Nuclei v3.2.7 adds `-uncover` search query support and `-scan-name` for pdcp uploads • `-uncover` option now accepts multiple search queries in templates • Adds `-sname` / `-scan-name` CLI flag to set the scan name during `pdcp result upload` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.6 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.6 Sat, 04 May 2024 19:50:17 GMT New `-profile`, `-profile-list`, and `-tgl` flags for template selection and listing • Adds `-profile` and `-profile-list` CLI options to run nuclei using pre-defined template profiles such as `aws-cloud-config`, `bugbounty`, or `pentest` • Adds `-tgl` (template-tags-list) flag to output a sorted list of all available template tags with their usage counts Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.5 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.5 Thu, 25 Apr 2024 13:07:22 GMT Nuclei v3.2.5 adds SRV DNS queries, HTTPX network policies, SDK catalog support, and context cancellation • Adds `SRV` query support to the dns protocol for resolving service discovery records • Adds a `networkpolicy` configuration option for httpx probes to control allowed protocols and hosts • Adds support for user-provided catalogs via the Nuclei SDK (`user_catalog`) • Adds context cancellation support to the Nuclei engine, allowing scans to be interrupted programmatically Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.4 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.4 Mon, 08 Apr 2024 21:31:01 GMT Nuclei v3.2.4 adds ASREProastable method in LDAP module for new attack vectors. • Adds `ASREProastable` detection method to the existing LDAP protocol support. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.3 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.3 Wed, 03 Apr 2024 16:34:11 GMT Adds `-dast` flag and `pre-condition` template attribute for fuzzing workflows • Adds `-dast` CLI flag to run exclusively DAST (fuzz) templates • Introduces `pre-condition` attribute support in Code and DAST templates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.2.0 Wed, 13 Mar 2024 22:44:40 GMT Nuclei v3.2.0 adds HTTP fuzzing (`-fuzz`), authenticated scanning, Gitea reporting, and `-payload-concurrency`. • Adds the `-fuzz` flag to load and execute fuzzing templates during scans • Introduces authenticated scanning capabilities for targeted tests • Adds `-payload-concurrency` option to control parallel payload execution • Enables reporting output to Gitea issue trackers • Implements transparent memoization via function annotations for performance • Adds a new JSONL output format for issue tracker integration along with CLI summary • Supports `self-contained` requests at the individual HTTP request level within templates • Enhances the ldap protocol with new capabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.10 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.10 Fri, 02 Feb 2024 17:06:25 GMT Nuclei v3.1.10 expands NetworkConfig SDK options for custom network configuration • `NetworkConfig` struct gains additional fields in the Go SDK, enabling finer control over network settings for custom templates and extensions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.9 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.9 Thu, 01 Feb 2024 23:40:24 GMT Adds automatic technology detection with `-as` flag and passive SDK support • Adds `-as` flag to enable automatic hybrid technology detection using Wappalyzer and tech templates during scans • Adds projectdiscovery/useragent module for user-agent handling • Adds passive option support in the SDK Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.7 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.7 Mon, 22 Jan 2024 21:53:47 GMT Nuclei v3.1.7 adds `-scan-id` to upload results to existing pdpc scans • Adds `-scan-id` CLI option to upload results to an existing PDCP scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.6 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.6 Thu, 18 Jan 2024 19:50:20 GMT Nuclei v3.1.6 adds `GetServiceTicket` and `GetKerberoastableUsers` methods to the kerberos and ldap modules for new attack capabilities. • Adds `GetServiceTicket` method to the kerberos module • Adds `GetKerberoastableUsers` method in ldap module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.4 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.4 Mon, 08 Jan 2024 09:49:51 GMT nuclei v3.1.4 adds self-contained fuzzing input, `-as` custom tags, internal matchers, and L4 layer exclusion. • `self-contained` is now supported for input in fuzzing templates, allowing templates to define their own input sources directly. • The `-as` CLI option accepts additional custom tags that are included with scan results. • Matchers can now be hidden from flow output by setting `internal: true` within the matcher definition. • Layer 4 scans via fastdialer now support an exclude list to filter out specific targets. Breaking changes: • The `to` attribute in extractor configurations is removed; file write operations in extractors are no longer supported for security reasons. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.3 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.3 Thu, 21 Dec 2023 12:45:22 GMT Nuclei v3.1.3 adds email support to the SMTP client and exposes a new Networkconfig interface in the SDK • Adds `email` support to the SMTP client within the javascript protocol Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.1 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.1 Sat, 09 Dec 2023 13:25:37 GMT nuclei v3.1.1 adds arbitrary string input support for TLS SNI annotation • `tls-sni` template annotation now accepts arbitrary string input instead of requiring a DNS name Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.0 https://github.com/projectdiscovery/nuclei/releases/tag/v3.1.0 Thu, 30 Nov 2023 17:34:18 GMT Nuclei v3.1.0 adds PDCP Dashboard integration, SSH command execution in JS templates, JSON output fields, and new filtering options • Added `-ms` CLI flag to include failed matches for errored hosts in scan output • Added `-dt` / `-dialer-timeout` and `-dka` / `-dialer-keep-alive` flags to set network request timeout and keep-alive duration • Added `host`, `host:port`, `ip`, `ip:port`, `cidr`, and regex patterns to the exclude feature for scan input list filtering • Added support for comma-separated ports in network template fields (e.g., `port: 22,2222`) • Added `port`, `scheme`, and `url` fields to JSON/JSONL output format • Added SSH command execution capability in JavaScript protocol templates via the `nuclei/ssh` module Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.0.4 https://github.com/projectdiscovery/nuclei/releases/tag/v3.0.4 Sat, 18 Nov 2023 09:21:26 GMT Nuclei v3.0.4 adds TLS version/cipher enumeration, JSON template output control, cookie reuse defaulting, and pprofiling via env var • `tls_version_enum` and `tls_cipher_enum` config options added to SSL protocol templates for TLS version and cipher enumeration • `-ot` / `-omit-template` flag added to exclude base64 encoded templates from JSON/JSONL output • Base64 encoding helpers added to the JavaScript protocol for custom templates • `cookie-reuse` enabled as default with `disable-cookie: true` config key to opt out • `PPROF=1` environment variable enables pprofiling without changing command flags Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v3.0.3 https://github.com/projectdiscovery/nuclei/releases/tag/v3.0.3 Thu, 02 Nov 2023 14:46:40 GMT Nuclei v3.0.3 adds self-contained template support to the headless protocol. • Added `self-contained` template support to headless protocol Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.15 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.15 Sat, 16 Sep 2023 16:01:01 GMT Nuclei v2.9.15 adds a `port` field to the network protocol template definition. • Added GH workflow for weekly performance test Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.14 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.14 Mon, 04 Sep 2023 10:30:10 GMT Nuclei v2.9.14 adds an `impact` field to template metadata for richer vulnerability context in output. • Adds an `impact` field to the template information block (e.g., in JSONL output) providing a description of exploitation consequences Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.13 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.13 Sat, 26 Aug 2023 08:47:01 GMT Nuclei v2.9.13 adds public template support via `-t`, xpath matchers, and headless file read restrictions. • Supports running public or shared templates from `templates.nuclei.sh` via the `-t` flag • Adds `xpath` as a new matcher type for template definitions • Applies file read restriction to the headless protocol, matching other protocols • Updates short options `-tu` and `-wu` to `-turl` and `-wurl` respectively • Renders `nuclei-templates` changelog in CLI output using the `-vv` option Breaking changes: • The short options `-tu` and `-wu` are now `-turl` and `-wurl` respectively Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.11 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.11 Fri, 18 Aug 2023 21:50:24 GMT Nuclei v2.9.11 adds request/response data in JSONL output for failed matches via `-ms` • Adds `request` and `response` fields to JSONL output when a match fails with the `-ms` option Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.10 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.10 Fri, 28 Jul 2023 16:47:41 GMT nuclei v2.9.10 adds MARKDOWN_EXPORT_SORT_MODE env var, headless-options flag, and wildcard -id filter • Adds the `MARKDOWN_EXPORT_SORT_MODE` environment variable to control sorting in markdown exports (template, severity, host) • Adds `-ho, -headless-options string[]` flag to pass additional options to headless Chrome • Adds wildcard pattern support to the `-id` option for filtering templates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.9 Mon, 17 Jul 2023 23:33:47 GMT Nuclei v2.9.9 adds JARM calculation, env var template source blocking, EPSS classification, and strict sandboxing flags • Adds environment variables `DISABLE_NUCLEI_TEMPLATES_PUBLIC_DOWNLOAD`, `DISABLE_NUCLEI_TEMPLATES_GITHUB_DOWNLOAD`, `DISABLE_NUCLEI_TEMPLATES_GITLAB_DOWNLOAD`, `DISABLE_NUCLEI_TEMPLATES_AWS_DOWNLOAD`, and `DISABLE_NUCLEI_TEMPLATES_AZURE_DOWNLOAD` to control template update sources • Adds the `{{jarm("host:port")}}` helper function for JARM hash calculation in templates • Adds `epss-percentile` attribute support in the `classification` section of templates • Introduces `-lfa` (`-allow-local-file-access`) and `-lna` (`-restrict-local-network-access`) flags to control sandbox behavior, replacing the deprecated `-sandbox` flag • Adds the `-or` (`-omit-raw`) option to exclude request/response pairs from JSON, JSONL, and Markdown outputs for findings only Breaking changes: • The `-sandbox` flag is removed; use `-lfa` and `-lna` instead to control sandbox behavior • Payload loading from arbitrary locations is now disabled by default; use `-lfa` to allow it if needed • Request/response inclusion in results is now enabled as default; use `-or` (`-omit-raw`) to exclude them Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.7 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.7 Mon, 26 Jun 2023 20:32:50 GMT Nuclei v2.9.7 adds ja3 TLS randomization, headless query fuzzing, {{public_ip()}} helper, and header/status matchers for headless templates. • Adds `-tlsi` (ja3 client hello randomization) CLI flag for TLS interception traffic manipulation • Adds query fuzzing support in the headless protocol via template expressions • Adds `{{public_ip()}}` helper function available in all templates to resolve the public IP • Adds `header` and `status` matchers for headless protocol detections • Adds `disable-path-automerge` option to raw request templates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.5 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.5 Sun, 28 May 2023 15:55:23 GMT Nuclei v2.9.5 adds DNS payload support, 'any' type queries, and template constants. • Adds `any` type query support in the dns protocol • Added support for constants in templates • Added payloads support in the dns protocol Breaking changes: • Removed `.yml` extension support for template input as URL Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.4 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.4 Thu, 11 May 2023 23:49:58 GMT nuclei v2.9.4 adds `--reset` flag to clear all configuration and templates • `--reset` command-line flag added to remove all nuclei configuration, data files, and template repositories in one step Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.3 https://github.com/projectdiscovery/nuclei/releases/tag/v2.9.3 Wed, 03 May 2023 20:44:41 GMT New DSL fields for DNS responses, template filtering by classification, mandatory severity enforcement, and extractor output to file. • Added support to filter templates based on classification • Added check to make `severity` as a mandatory field • Adds the `output` option to save extractor results to a file Breaking changes: • The `severity` field is now mandatory in templates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/nuclei