Nuclei, a vulnerability scanner by ProjectDiscovery, continues to evolve with active community involvement, but faces critical stability issues as evidenced by multiple high-priority bugs.
The project is designed to perform security checks across various protocols using customizable templates, aiming for zero false positives. It is supported by a vibrant community contributing to its extensive template repository.
Recent issues highlight significant stability concerns, particularly with the headless protocol and memory usage during scans. Issues like #5580 and #5579 indicate critical bugs affecting functionality, while feature requests such as #5581 and #5567 show ongoing interest in expanding capabilities.
Development activities reflect a strong focus on both bug fixes and feature enhancements. Key contributors include:
Summary
Quantified Reports
Detailed ReportsActionWaitDialog (#5545) show ongoing enhancement efforts.| Timespan | Opened | Closed | Comments | Labeled | Milestones |
|---|---|---|---|---|---|
| 7 Days | 16 | 7 | 19 | 1 | 2 |
| 30 Days | 49 | 32 | 57 | 1 | 3 |
| 90 Days | 137 | 90 | 198 | 1 | 5 |
| 1 Year | 390 | 198 | 557 | 10 | 11 |
| All Time | 2354 | 2056 | - | - | - |
Like all software activity quantification, these numbers are imperfect but sometimes useful. Comments, Labels, and Milestones refer to those issues opened in the timespan in question.
| Developer | Avatar | Branches | PRs | Commits | Files | Changes |
|---|---|---|---|---|---|---|
| Dwi Siswanto |  |
2 | 13/10/2 | 19 | 29 | 866 |
| Tarun Koyalwar |  |
2 | 4/3/0 | 6 | 24 | 359 |
| Dogan Can Bakir |  |
3 | 6/6/0 | 13 | 20 | 332 |
| dependabot[bot] |  |
2 | 27/24/2 | 25 | 2 | 225 |
| Mzack9999 |  |
1 | 0/0/0 | 4 | 8 | 220 |
| Ramana Reddy |  |
2 | 3/3/0 | 4 | 13 | 212 |
| Deleted user |  |
1 | 0/0/0 | 1 | 3 | 135 |
| Mohammed Diaa |  |
1 | 0/1/0 | 1 | 11 | 133 |
| Tryfon Papatriantafyllou |  |
1 | 2/2/0 | 2 | 6 | 64 |
| Roy Reznik |  |
1 | 1/1/0 | 1 | 3 | 31 |
| Ice3man |  |
1 | 1/1/0 | 1 | 1 | 13 |
| Sandeep Singh |  |
1 | 2/1/0 | 2 | 4 | 9 |
| alban-stourbe-wmx |  |
1 | 0/1/0 | 1 | 1 | 7 |
| Peter Kasza |  |
1 | 1/1/0 | 1 | 1 | 3 |
| Peter Dave Hello |  |
1 | 1/1/0 | 1 | 1 | 2 |
| 4shen0ne (zrquan) | 0 | 1/0/0 | 0 | 0 | 0 | |
| geeknik (geeknik) | 0 | 0/0/2 | 0 | 0 | 0 |
PRs: created by that dev and opened/merged/closed-unmerged during the period
The Nuclei GitHub repository has seen a significant amount of recent activity, with 298 open issues currently being tracked. Among these, there are numerous bug reports and feature requests, indicating an active engagement from the community and developers. Notably, there are several issues related to bugs in the headless protocol, template validation, and performance optimizations. A recurring theme is the need for enhancements in handling various protocols and improving the user experience with clearer error messages and more robust functionality.
Several issues stand out due to their implications for the project's stability and usability. For instance, issues related to the headless protocol not properly handling relative paths could hinder users attempting to automate scans on dynamic web applications. Additionally, the ongoing discussions about memory usage optimizations highlight a critical area for improvement as users report crashes during extensive scans.
Here are some of the most recently created and updated issues:
Issue #5582: [BUG] Unable to get stats when running two Nuclei instances
Issue #5581: [FEATURE] DNS TRACE
Issue #5580: [BUG] Escaping string in dsl function: "Cannot transition token types from STRING [] to VARIABLE [xxxx]"
Issue #5579: [BUG] -eh options makes nuclei stuck
Issue #5577: [BUG] Using the timeout parameter results in abnormal termination
Issue #5569: Android(arm64)Not working properly
Issue #5567: [FEATURE] Template Profile Improvements
Issue #5566: [FEATURE] Add Integrations or providers for Secrets File
Issue #5565: [FEATURE] Support Tamper Scripts via Javascript using passive templates
Issue #5564: [BUG] Fix target being skipped due to max-host-error
This analysis highlights critical areas that require attention to ensure that Nuclei continues to meet user needs effectively while maintaining robust performance across various use cases.
The project repository for Nuclei has a total of 18 open pull requests (PRs) and a significant history of closed PRs, indicating active development and maintenance. The recent PRs focus on various improvements, bug fixes, and dependency updates, reflecting ongoing efforts to enhance functionality and stability.
PR #5583: Nuclei - v3.3.2 release prep
PR #5572: chore(deps): bump github.com/projectdiscovery/retryablehttp-go from 1.0.74 to 1.0.75
PR #5563: WIP: Openapi input mode bug fixes
PR #5554: support stop-at-first-match for network templates
PR #5545: feat(headless): add ActionWaitDialog type
PR #5243: Add ncat command to replicate raw request
PR #4723: feat: first implementation of global matchers
PR #5515: fix findGlobPathMatches
PR #5421: Add more support for fs.FS in template parsing
PR #5370: disable non-default templates as default
Various other PRs related to dependency updates and minor fixes (e.g., PRs #5538, #5537, etc.) that reflect routine maintenance and improvements in code quality.
The current landscape of pull requests within the Nuclei project highlights several key themes:
The presence of numerous open PRs indicates a vibrant development cycle, with contributors actively working on both new features (such as the ActionWaitDialog type and global matchers) and critical bug fixes (like those addressing OpenAPI input mode). This dual focus on enhancement and stability is vital for maintaining user trust and software reliability.
A significant number of recent PRs involve updating dependencies (e.g., retryablehttp-go, gologger). This reflects an awareness of the importance of keeping dependencies current to mitigate security risks and leverage improvements from upstream libraries. Regular updates are essential in modern software development to ensure compatibility with other components and frameworks.
The variety of contributors involved in these PRs suggests a healthy community around the project. Contributions from different developers not only bring diverse perspectives but also foster collaboration that can lead to innovative solutions and enhancements.
Some older PRs (like #4723 regarding global matchers) indicate ongoing discussions about implementing complex features that may require more extensive testing or integration efforts before merging. The delay in merging these could suggest challenges in achieving consensus on design or implementation strategies among maintainers.
While there is a high volume of open PRs, it is essential to monitor how many are being merged regularly. The frequency of merges can serve as an indicator of project health; if many PRs remain open without merging, it may signal resource constraints or prioritization issues within the team.
Several PRs include references to tests or documentation updates, which are critical for maintaining code quality as new features are added or existing ones modified. Ensuring that tests accompany changes helps prevent regressions and maintains confidence in the software's functionality.
Overall, the Nuclei project appears to be in a robust state of development with active contributions focused on both enhancing features and maintaining stability through dependency management and bug fixes. However, attention should be given to older PRs that may need resolution or further discussion to ensure they do not hinder progress on newer initiatives.
Dwi Siswanto (dwisiswant0)
mapsutil.Map, and adding various features related to headless actions. Collaborated with Dogan Can Bakir on multiple features and bug fixes.Dogan Can Bakir (dogancanbakir)
-ms option for scanning non-accessible hosts, improving error logging, and adding integration tests. Also involved in minor lint fixes and dependency updates.Peter Dave Hello (PeterDaveHello)
Dependabot[bot]
Mzack9999
AdallomRoy
Ice3man543
Sandeep Singh (ehsandeep)
Tarun Koyalwar (tarunKoyalwar)
Tryfon Papatriantafyllou (trypa11)
Ramana Reddy (RamanaReddy0M)
Ghost
Mrschyte (Peter Kasza)
Alban Stourbe (alban-stourbe-wmx)
Mohammed Diaa (mhmdiaa)
The development team demonstrates strong collaboration and active contributions towards enhancing the Nuclei project through both feature additions and maintenance tasks. The focus on robust error handling and dependency management reflects a commitment to quality and stability within the software project.