Download Latest Version
nuclei_3.11.0_linux_386.zip (41.0 MB)
Get an email when there's a new version of nuclei
| Name | Modified | Size | Downloads / Week |
|---|---|---|---|
| Parent folder | |||
| nuclei_3.11.0_checksums.txt | 2026-07-06 | 766 Bytes | |
| nuclei_3.11.0_linux_386.zip | 2026-07-06 | 41.0 MB | |
| nuclei_3.11.0_linux_amd64.zip | 2026-07-06 | 43.6 MB | |
| nuclei_3.11.0_linux_arm64.zip | 2026-07-06 | 39.1 MB | |
| nuclei_3.11.0_macOS_arm64.zip | 2026-07-06 | 41.2 MB | |
| nuclei_3.11.0_windows_386.zip | 2026-07-06 | 41.6 MB | |
| nuclei_3.11.0_windows_amd64.zip | 2026-07-06 | 43.5 MB | |
| nuclei_3.11.0_linux_arm.zip | 2026-07-06 | 41.5 MB | |
| nuclei_3.11.0_macOS_amd64.zip | 2026-07-06 | 44.6 MB | |
| README.md | 2026-07-06 | 2.4 kB | |
| v3.11.0 source code.tar.gz | 2026-07-06 | 12.3 MB | |
| v3.11.0 source code.zip | 2026-07-06 | 12.9 MB | |
| Totals: 12 Items | 361.3 MB | 69 | |
What's Changed
⚠️ Breaking Change: Signed templates required for JavaScript protocol
Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.
Why this change
This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in #7469). The JavaScript protocol exposes Go-backed modules through Nuclei's JS runtime, which significantly increases attack surface compared with request-only templates. Requiring signatures brings JavaScript templates in line with the existing protections for code-protocol templates.
Who is affected
| Scenario | Impact |
|---|---|
| Default scans using nuclei-templates | No action needed - official templates are pre-signed and verified with ProjectDiscovery's public key |
Custom/private templates using javascript: |
Action required - sign templates before use |
Templates using only flow: (e.g. flow: http(1)) without javascript: |
No change |
| Workflows referencing unsigned JavaScript sub-templates | Those sub-templates are skipped |
What to do
Sign your custom templates with:
:::bash
nuclei -sign -t /path/to/your-template.yaml
See the Template Signing documentation for key generation, verification, and signing templates that reference external JavaScript or code files.
🔒 Security
- feat(templates): require signatures for javascript templates by @dwisiswant0 in https://github.com/projectdiscovery/nuclei/pull/7514
Other Changes
- bump x/crypto and go-pkcs12 by @dogancanbakir in https://github.com/projectdiscovery/nuclei/pull/7516
- general maintenance and cleanup by @Mzack9999 in https://github.com/projectdiscovery/nuclei/pull/7469
Full Changelog: https://github.com/projectdiscovery/nuclei/compare/v3.10.0...v3.11.0