Scanning host:port still scans the whole host

[bpce-it-dis-soc-sof]

 nuclei -ts -u localhost:8081 -jsonl -bulk-size 100 -exclude-tags intrusive -hang-monitor -omit-raw -rsr 100000 -severity high,critical -stats -stats-json -tags network,ssl -header 'User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36' -rate-limit 40000 -c 100 -timeout 10

Running the following command, nuclei still gives me a vulnerability on localhost:445 --> why ?

How can I restrict nuclei to just the target I passed: I didn't mean to scan all the other ports than 8081.

[dev-rehaann]

This was a Nuclei bug for explicitly supplied ports in the reserved-port set (80, 443, 8080, 8443, 8081, 53). A network template could replace localhost:8081 with its own port: value, so an SMB template selected by the broad network,ssl tags could dial 445.

It was fixed by #7465, released in v3.10.0. Upgrade and verify the version:

nuclei -up
nuclei -version

With v3.10.0 or newer, a bare explicit target such as localhost:8081 is preserved. If you still see 445 on a current version, run with request debugging and note the template ID; a template that hard-codes an address needs to be handled separately or excluded.

Two related details: -tags network,ssl intentionally selects a wide set of service templates, and -ts only enables timestamps—it does not constrain target scope. For a hard safety boundary, select only the specific templates you intend to run and enforce the allowed destination port with the scanner host's firewall.