Templates that send multi-MB bodies (e.g. CVE-2026-109618 sends 1, 8 and
20 MB) kept 8-10 copies of each body alive per request. With 25 hosts in
flight this reached ~10 GB RSS and OOM-killed scan VMs.
- add pkg/utils/httpbody: a zero-copy request body that rewinds on EOF;
GetBody hands out new cursors over the same slice instead of cloning
- build raw, model and fuzzed request bodies with httpbody instead of
retryablehttp's ReusableReadCloser, which tees every read into a second
growing buffer and clones on each GetBody
- dump requests with http.Request.Write into a capped writer instead of
retryablehttp Dump/httputil.DumpRequestOut; output is unchanged for
bodies under the cap
- keep only the first 32 KiB of a body in request dumps (new
-rqss/-request-size-save flag, 0 keeps all) and leave bodies over 4 KiB
out of curl commands
- build the project cache key only when a project file is used, hashing
the body when the dump is truncated
- replay sends the full body when the dump was truncated
- slice the raw request body from the request instead of reading it out
- pass replacer values to fasttemplate as []byte so writes don't copy them
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Adds -utc / -update-templates-channel (stable, latest). stable keeps the
current behaviour. latest installs the head of the nuclei-templates main
branch, so templates merged after the last release are available without
waiting for the next one.
The version for the latest channel is the last release plus the short
commit as semver build metadata (e.g. v10.5.0+3de629d). Build metadata is
ignored when comparing versions, so switching back to stable doesn't
downgrade, and only a newer release makes it outdated there. Since the
version check only knows about releases, the latest channel compares the
installed version against the current head to decide when to update.
The channel can also be set in the config file like the other options.
Closes#5608
Fuzzing takes the request shape from the input, so a bare URL is always fuzzed
as a GET and anything else needed a spec, captured traffic or a hand-written
proxify document. -im http reads requests as they appear on the wire, which is
what Burp and browser devtools already put on the clipboard.
* store and generate signer keys
* fix trailing newline in code_response
* fix formatting and update error string
* fix integration test
* fix rsaSigned code integration test
* bug fixes , docs and more
* bump go -> 1.21
* use 'response' as default part in code templates
* disable sourcemaps for all js runtimes
* disable eval function
* rewrite file validation in sandbox mode
* sandbox file read improvements + minor refactor
* refactor sign and verify logic
* fix panic and missing id in code protocol
* disable re-signing code protocol templates
* fix code resigning in tests
* allow -lfa in test for signing templates
* start index from 1 in flow and multiproto
* remove testfiles
* add python in integration test
* update code protocol docs
* add python engine in template
* rework template signer
* fix integration test and more
* reworked template signer
* fix lint error
* display signature stats
* update docs
* add user fragment to signature
* use md5 to generate fragment
* update docs with code re-sign
* misc updates
* public crt update
* remove workflow info statement
* fix printing issues
* refactor preprocessor logic
* remove debug statement
* fix failing example test
* go mod tidy
---------
Co-authored-by: sandeep <[email protected]>
Co-authored-by: Sandeep Singh <[email protected]>
* Add command docs and CLI hook
* Add configurable exclusion from reports
* Register the CLI argument with exporter configuration
* Switch to inverted logic with JSONRequest flag
* Switch variable name for the -include-rr/-irr flag
* Remove flags from README
* Update call for -irr and -or
* convert -irr to no-op
---------
Co-authored-by: Tarun Koyalwar <[email protected]>
* Allow user to specify for "context deadline exceeded" errors to count toward the max host error count
* Convert flag to a string slice `--track-error`
* Minimize diff
* Add documentation for `-track-error`
* adds unit test & minor improvements
* update flag description
---------
Co-authored-by: Austin Traver <[email protected]>
Co-authored-by: Tarun Koyalwar <[email protected]>
* added logs for debug
* fixes
* removed logs
* using cache item
* implemented multiple tests
* fixed some unit tests
* implemented test for skipping
* added multiple tests together
* added mark failed
* fix on tests
* better test implementation + concurrent
* fix: fixes on concurrent tests
* removed parallel and 1 unit test
DOCS: by default the command go test runs in parallel tests for different packages, and default is the number of CPUs available (see go help build)
* fixes on go routine
* increasing parallelism of once.Do
* bumping go to 1.19 for atomic types support
* removing redundant check + fixing test concurrency on create
Co-authored-by: Mzack9999 <[email protected]>
Co-authored-by: mzack <[email protected]>
Dogan Can Bakir