Repository navigation

Issues

New issue

What features would you want to see in nuclei?
#2542 · ehsandeep opened on Sep 2, 2022
Where does nuclei fit into your pipeline/use cases?
#2541 · ehsandeep opened on Sep 2, 2022
import already existing templates within a template
#4287 · iamnoooob opened on Oct 24, 2023
1

scan waits on stdin even when targets are given with -u or -l
projectdiscovery/nuclei#7880 · opened on Oct 15, 2026 · nuclei v4
recorded request can lose its body when the server answers before reading it
projectdiscovery/nuclei#7878 · opened on Oct 15, 2026 · nuclei v4
[BUG] proxy-handling gap in 3.11.1
projectdiscovery/nuclei#7875 · opened on Oct 14, 2026
Honour template max-size under the global response read limit
projectdiscovery/nuclei#7873 · opened on Oct 13, 2026
[BUG] Headless mode allows WebSocket connections to excluded hosts
projectdiscovery/nuclei#7867 · opened on Oct 13, 2026
1
[BUG] -stats percentage comes from an estimated request total and ends above or below 100%
projectdiscovery/nuclei#7860 · opened on Oct 11, 2026
SDK v3: embedded engine intermittently executes zero templates (no error) with local template sources + DisableUpdateCheck
projectdiscovery/nuclei#7859 · opened on Oct 11, 2026
2
[BUG] http-to-https-tracker never retries the request that first discovers an HTTPS-only port, causing false negatives
projectdiscovery/nuclei#7849 · opened on Oct 7, 2026
Skip full HTTP response copy when operators do not read it
projectdiscovery/nuclei#7829 · opened on Oct 5, 2026
[BUG] ip is empty behind -proxy even for IP-literal targets, so Host != ip dsl matcher never excludes IPs
projectdiscovery/nuclei#7825 · opened on Oct 5, 2026
[BUG] Extractor fields applied to the wrong extractor type are silently ignored
projectdiscovery/nuclei#7808 · opened on Sep 30, 2026
cut CI runtime
projectdiscovery/nuclei#7803 · opened on Sep 30, 2026 · nuclei v4
OpenAPI importer sends format: binary octet-stream bodies as text/plain
projectdiscovery/nuclei#7801 · opened on Sep 29, 2026
[BUG] RequestResponse.MarshalJSON emits base64 strings that its own UnmarshalJSON cannot decode (JSONCodec round-trip broken)
projectdiscovery/nuclei#7795 · opened on Sep 28, 2026
apply host backoff to non-http protocols
projectdiscovery/nuclei#7794 · opened on Sep 28, 2026 · nuclei v4
auto-login for authenticated scans
projectdiscovery/nuclei#7788 · opened on Sep 28, 2026 · nuclei v4
[BUG] OpenAPI input panics on an application/xml request body without an object schema
projectdiscovery/nuclei#7785 · opened on Sep 27, 2026
[BUG] JS mysql.ConnectWithDSN bypasses -restrict-local-network-access network policy via raw DSN dialer
projectdiscovery/nuclei#7767 · opened on Sep 22, 2026
[BUG] Invalid XPath extractor expressions compile successfully and are silently skipped
projectdiscovery/nuclei#7750 · opened on Sep 16, 2026
Headless templates download full Chromium on Linux
projectdiscovery/nuclei#7738 · opened on Sep 14, 2026 · nuclei v4
[BUG] SDK: .nuclei-ignore is read before the installer creates it, so the first engine runs with an empty deny-list
projectdiscovery/nuclei#7704 · opened on Sep 4, 2026
2
[BUG] ThreadSafeNucleiEngine: live heap scales with concurrent ExecuteNucleiWithOptsCtx calls (compiled template store rebuilt per call, DoNotCache)
projectdiscovery/nuclei#7686 · opened on Sep 1, 2026 · nuclei v4
1
http: expose negotiated TLS key exchange in DSL metadata
projectdiscovery/nuclei#7665 · opened on Aug 17, 2026
[BUG] Nuclei template signature bypass: mtime-only metadata cache runs unsigned code templates
projectdiscovery/nuclei#7663 · opened on Aug 17, 2026
2
[BUG] Fatal runtime fault (access violation 0xc0000005) crashes nuclei daily during concurrent scans on Windows Server 2025
projectdiscovery/nuclei#7630 · opened on Jul 31, 2026
1

Navigation Menu

Repository navigation

Issues

Issues

scan waits on stdin even when targets are given with -u or -l

recorded request can lose its body when the server answers before reading it

[BUG] proxy-handling gap in 3.11.1

Honour template max-size under the global response read limit

[BUG] Headless mode allows WebSocket connections to excluded hosts

[BUG] -stats percentage comes from an estimated request total and ends above or below 100%

SDK v3: embedded engine intermittently executes zero templates (no error) with local template sources + DisableUpdateCheck

[BUG] http-to-https-tracker never retries the request that first discovers an HTTPS-only port, causing false negatives

Skip full HTTP response copy when operators do not read it

[BUG] `ip` is empty behind -proxy even for IP-literal targets, so `Host != ip` dsl matcher never excludes IPs

[BUG] Extractor fields applied to the wrong extractor type are silently ignored

cut CI runtime

OpenAPI importer sends format: binary octet-stream bodies as text/plain

[BUG] RequestResponse.MarshalJSON emits base64 strings that its own UnmarshalJSON cannot decode (JSONCodec round-trip broken)

apply host backoff to non-http protocols

auto-login for authenticated scans

[BUG] OpenAPI input panics on an application/xml request body without an object schema

[BUG] JS mysql.ConnectWithDSN bypasses -restrict-local-network-access network policy via raw DSN dialer

[BUG] Invalid XPath extractor expressions compile successfully and are silently skipped

Headless templates download full Chromium on Linux

[BUG] SDK: .nuclei-ignore is read before the installer creates it, so the first engine runs with an empty deny-list

[BUG] ThreadSafeNucleiEngine: live heap scales with concurrent ExecuteNucleiWithOptsCtx calls (compiled template store rebuilt per call, DoNotCache)

http: expose negotiated TLS key exchange in DSL metadata

[BUG] Nuclei template signature bypass: mtime-only metadata cache runs unsigned code templates

[BUG] Fatal runtime fault (access violation 0xc0000005) crashes nuclei daily during concurrent scans on Windows Server 2025