What's Changed Security Fixes Templates: Centralize opt-in capability gating across loaders and workflows by @dwisiswant0 (#7489) GHSA-qgw5-7j4f-fg97 JS/MySQL: Gate allowAllFiles behind -lfa by @dogancanbakir (#7473) GHSA-xhmx-w2j4-rw3q Templates: Validate code template signatures before DAST loading by @dogancanbakir (#7472) GHSA-jpf4-98qj-qr67 JS: Update Goja dependency by @Mzack9999 (#7467) GHS…
What's Changed ⚠️ Breaking Change: Signed templates required for JavaScript protocol Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows. Why this change This release continues the security hardening started…
What's Changed 🎉 New Features Added support for protocol redirects by @Mzack9999 in #7296 Added impacket integration by @Mzack9999 in #7356 Added wmi, tsch, scmr, and dcom helper modules for JS by @dwisiswant0 in #7388 Added mirroring of -config, -report-config, and -dashboard flags for SDK callers by @ShubhamRasal in #7393 🐞 Bug Fixes Fixed DNS variables resolving issue by @Mzack9999 in #7379 Fix…
What's Changed Security Fixes JS: Respect allow-local-file-access in require by @dwisiswant0 (#7332) CVE-2026-41646 - GHSA-29rg-wmcw-hpf4 Expressions: Only evaluate template-authored expressions by @dwisiswant0 (#7221)(#7321) CVE-2026-41645 - GHSA-jm34-66cf-qpvr Bug Fixes HTTP: Respect annotations in unsafe mode by @dwisiswant0 (#7044) HTTP: Isolate project cache keys by scheme & host by @dwisiswa…
What's Changed 🐞 Bug Fixes Fixed panic by replacing it with error handling in template loader (#6674) by @umer12-12 in #7090 Fixed cluster failure handling by @bf-rbrown in #6843 Fixed by avoiding cross-test chrome teardown races in headless by @dwisiswant0 in #7053 Fixed data race in evaluateVarsWithInteractsh by @yusei-wy in #6828 Fixed panic by replacing it with error handling in template loade…
What's Changed 🎉 New Features Added cdp-endpoint option to allow users to specify a WebSocket endpoint for control in headless mode by @dwisiswant0 in #5786 Added RSYNC module by @Mzack9999 in #6410 🐞 Bug Fixes Fixed resume file path condition by @dogancanbakir in #6784 Fixed race condition regression by @dwisiswant0 in #6748 Fixed duplicate log spam for permanent errors by @dwisiswant0 in #6697 F…
What's Changed ✨ New Features Enabled TLS session caching in the client pool to improve connection reuse and reduce handshake overhead (internal) by @dwisiswant0 in #6713 Added support for providing a custom Jira server URL (site-url) when using OAuth authentication by @Ice3man543 in #6716 🐞 Bug Fixes Improved duplicate issue detection by properly paginating Gitea issue searches by @leonjza in #67…
What’s Changed 🐞 Bug Fixes fix(config): template exclusion logic for paths with reserved names by @dwisiswant0 in #6663 fix(http): lost request body on retries & redirects by @dwisiswant0 in #6666 fix(http): pass dynamicValues to EvaluateWithInteractsh by @dwisiswant0 in #6685 fix(lib): segfault when initializing the engine with EnableHeadlessWithOpts by @dwisiswant0 in #6602 build: fix compilatio…
What's Changed ✨ New Features Write resume file specified by flag by @circleous (#6616) Javascript Multi-Port Support by @pussycat0x (#6501) Direct fuzzing using target URL for OpenAPI/Swagger by @roiswd (#6542) Bump DSL with .NET deserialization helpers by @Ice3man543 (#6625) Implement persistent metadata cache in loader by @dwisiswant0 (#6630) Check for undefined params for lazy evaluation in va…
What's Changed Remove genproto replace directives from go.mod by @ehsandeep in #6608 Full Changelog: v3.5.0...v3.5.1
What's Changed 🎉 New Features Adding json + xpath headless extractors by @Mzack9999 in #6559 Adding VNC auth by @Mzack9999 in #6413 Feat(templating): add vars templating into yaml inputs (ytt) by @alban-stourbe-wmx in #6261 Feat: added new text/template syntax to jira custom fields by @Ice3man543 in #6464 Feat(fuzz): enhance MultiPartForm with metadata APIs by @dwisiswant0 in #6486 Feat: http(s) p…