v3.11.0

What's Changed

⚠️ Breaking Change: Signed templates required for JavaScript protocol

Starting with v3.11.0, custom templates that use the javascript: protocol must be digitally signed before Nuclei will load or execute them. Unsigned JavaScript templates are now skipped during template loading and when referenced from workflows.

Why this change

This release continues the security hardening started in v3.10.0 (sandbox enforcement, network policy checks, stricter code-template handling, YAML include protections, and related fixes in
No action needed - official templates are pre-signed and verified with ProjectDiscovery's public key


Custom/private templates using javascript:
Action required - sign templates before use


Templates using only flow: (e.g. flow: http(1)) without javascript:
No change


Workflows referencing unsigned JavaScript sub-templates
Those sub-templates are skipped

What to do

Sign your custom templates with:

nuclei -sign -t /path/to/your-template.yaml

See the in in in