Nuclei: YAML-based vulnerability scanner
Template-based multi-protocol security scanner for CI/CD pipelines.
Learn more about Nuclei
Nuclei is a command-line vulnerability scanner written in Go that executes security checks defined in YAML template files. The tool processes templates through a DSL that supports multiple protocols including HTTP, TCP, DNS, SSL, WHOIS, and JavaScript execution. It performs parallel scanning with request clustering to process multiple targets efficiently. Common deployment contexts include security assessments, CI/CD pipeline integration, and regression testing workflows.
YAML-based template system
Vulnerabilities are defined as declarative YAML templates rather than compiled code, allowing security researchers to contribute detection logic without programming expertise. Templates can simulate multi-step attack scenarios to reduce false positives.
Multi-protocol support
The scanner handles HTTP, TCP, DNS, SSL, WHOIS, JavaScript, and code-based checks within a single framework. This breadth allows detection across different attack surfaces including web applications, network services, and DNS configurations.
Community-driven template library
Nuclei maintains a separate repository of templates contributed by security professionals. This distributed model enables rapid response to emerging vulnerabilities without requiring core tool updates.
Added cdp-endpoint option for WebSocket control in headless mode, RSYNC module, and fixed resume file path and race conditions.
- –Added cdp-endpoint option to allow users to specify a WebSocket endpoint for control in headless mode
- –Added RSYNC module
- –Fixed resume file path condition
- –Fixed race condition regression
- –Fixed duplicate log spam for permanent errors
Enabled TLS session caching, improved Jira and GitLab integration, and restored JavaScript template execution.
- –Enabled TLS session caching in the client pool to improve connection reuse and reduce handshake overhead
- –Added support for providing a custom Jira server URL (site-url) when using OAuth authentication
- –Improved duplicate issue detection by properly paginating Gitea issue searches
- –Restored JavaScript template execution when the Port argument is not provided
- –Added pagination support when searching for duplicate issues in GitLab
Fixed template exclusion logic, HTTP request body handling, and compilation issues on loong64 architecture.
- –fix(config): template exclusion logic for paths with reserved names
- –fix(http): lost request body on retries & redirects
- –fix(http): pass dynamicValues to EvaluateWithInteractsh
- –fix(lib): segfault when initializing the engine with EnableHeadlessWithOpts
- –build: fix compilation on loong64 architecture
See how people are using Nuclei
Related Repositories
Discover similar tools and frameworks used by developers
Gitleaks
Regex-based secret scanner for git repositories.
WhatsMyName
JSON dataset for checking username availability across hundreds of websites for OSINT tools.
OSINT-Framework
Structured web catalog of free OSINT tools.
Prowler
Cloud security platform automating assessments and compliance across AWS, Azure, GCP, and K8s.
Subfinder
Passive subdomain discovery via DNS resolution and validation.
Related Reading
Guides and comparisons from the Greptile content library
Best Developer Productivity Tools in 2026
The best developer productivity tools in 2026, compared by the workflow problem they solve: code review, autocomplete, AI-native editing, terminal agents, code search, observability, and security.
Top AI Code Review Tools for Small Dev Teams 2026
Affordable, lightweight AI code review tools that help small teams catch bugs faster. Practical comparisons of accuracy, ease of use, and value for teams without enterprise budgets.
Best AI Code Review Tools for GitLab
Enterprise-grade AI code review tools for GitLab teams. In-depth comparison of accuracy, security, and integration features to accelerate your merge request workflows.
Greptile Ranks #1 on Martian's AI Code Review Benchmark
Greptile ranks #1 on Martian's independent online AI code review benchmark, leading all evaluated tools in F1 score and precision with near-leading recall.