Nuclei
By ProjectDiscovery
Nuclei is an open-source vulnerability scanner that uses community-contributed YAML templates to check hosts and applications for specific, known security issues at high speed. Instead of a monolithic scan engine, it runs an ever-growing…
Definition
Nuclei is an open-source vulnerability scanner that uses community-contributed YAML templates to check hosts and applications for specific, known security issues at high speed. Instead of a monolithic scan engine, it runs an ever-growing library of independently written templates covering CVEs, misconfigurations, exposed panels, and default credentials, making it popular for fast, targeted reconnaissance across large numbers of targets during bug bounty and attack surface monitoring work.
Overview
Nuclei addresses the gap between heavyweight traditional vulnerability scanners, which are thorough but slow and hard to extend, and the need many security teams and researchers have to quickly check thousands of hosts for one specific, newly disclosed issue. It was built around the idea that a vulnerability check should be a small, declarative, shareable file rather than code buried inside a scanner's internals, so the community can write and publish new checks within hours of a vulnerability's disclosure. Mechanically, each nuclei check is a YAML template describing a request to send, matchers that inspect the response for signs the vulnerability is present, and metadata like severity and a reference identifier. The nuclei engine loads a set of templates, sends the described requests against target hosts concurrently, and reports which templates matched. Because templates are plain text and version-controlled in a public repository, ProjectDiscovery and the wider community publish new templates rapidly after a CVE or exposure type becomes known, and organizations can also write private templates for internally discovered issues. The engine supports protocols beyond HTTP, including DNS, TCP, and cloud provider checks, and can run tens of thousands of templates against a target set with efficient concurrency. Nuclei sits closer to fast, template-driven reconnaissance than to deep, stateful scanning; it is commonly compared to OpenVAS or Nessus, which run broader, heavier scans with built-in vulnerability logic, whereas nuclei's strength is breadth and speed across many hosts once a specific signature exists. It is often used as a first-pass triage tool ahead of a deeper, more manual assessment with a tool like Burp Suite or sqlmap once nuclei flags something worth investigating. In practice, security teams run nuclei continuously across their external attack surface to catch newly disclosed CVEs and misconfigurations as soon as templates are published, and bug bounty researchers use it to quickly triage large scopes for known issue classes before switching to manual testing. Cloud security teams also use its dedicated templates to check for common cloud misconfigurations and exposed services. The main limitation is that nuclei only finds what a template exists for; it does not discover novel or logic-based vulnerabilities the way manual testing or a skilled tester can, and its usefulness depends entirely on template coverage and freshness. Running an out-of-date or narrow template set gives a false sense of security, and, like any active scanner, aggressive template sets can generate meaningful load or false positives against sensitive production systems if not scoped carefully.
Key Features
- YAML-based templates that make writing and sharing new checks fast
- Thousands of community-maintained templates covering CVEs and misconfigurations
- High-concurrency scanning engine suited to large target lists
- Multi-protocol support including HTTP, DNS, TCP, and cloud checks
- Severity and metadata tagging for filtering and prioritizing results
- Workflow support for chaining multiple templates into a single check
- Integration with CI pipelines and other reconnaissance tooling
- Rapid template publication after new CVE disclosures