6 August 2026
Nmap 7.991 is the current stable release, dated 6 August 2026. The Windows installer is nmap-7.991-setup.exe at 36 MB. The macOS disk image is 34 MB. The bzip2 source tarball is 12 MB.
Windows builds run on Windows 7 and newer, and on Windows Server 2008 R2 and newer, including Windows 10 and 11. The setup includes Zenmap and a recent Npcap. The bundled Npcap is not always the newest Npcap release. Npcap 1.89 is the latest Npcap release listed beside 7.991. Nmap 7.99 had moved the bundled driver from 1.83 to 1.87.
nmap-7.991-setup.exe · 36 MB. Self-installer with Nmap, Zenmap, Ncat, Ndiff, Nping, and Npcap. Leave "Register Nmap Path" checked if you want nmap in a command prompt.
nmap-7.991.dmg · 34 MB. x86-64 installer tested on Mac OS X 10.9 and later. It can install Nmap, Zenmap, Ncat, and Ndiff.
nmap-7.991.tar.bz2 · 12 MB. Also published as nmap-7.991.tgz at 15 MB. Builds on Linux, macOS, Windows, and other UNIX systems.
nmap-7.991-1.x86_64.rpm · 8.2 MB. Separate RPMs exist for Ncat and Nping at about 1.9 MB and 1.8 MB. Zenmap for this release is a Python 3 wheel, zenmap-7.991-py3-none-any.whl, 970 KB, not an RPM.
Requirements
| Platform | Requirement | File | Size |
|---|---|---|---|
| Windows | Windows 7, 8, 8.1, 10, 11, or Server 2008 R2 and newer. Npcap for raw scans. Visual C++ runtime, which many PCs already have. | nmap-7.991-setup.exe | 36 MB |
| macOS | Mac OS X 10.9 or later. The published disk image is x86-64. | nmap-7.991.dmg | 34 MB |
| Linux | x86-64 RPM, or compile the tarball. A C compiler and the usual build tools are required for source. | nmap-7.991-1.x86_64.rpm | 8.2 MB |
| Source | Linux, macOS, Windows, Solaris, and the BSDs are the usual compile targets. | nmap-7.991.tar.bz2 | 12 MB |
The Windows installer is a Nullsoft setup. It asks for a folder and which pieces to keep: Nmap core files, the PATH registration, the packet driver, Zenmap, Ncat, and Ndiff. Nping is part of the suite as well.
An older setup capture still lists WinPcap. Current installers install Npcap instead. Do not go looking for a WinPcap checkbox on 7.991. That window is shown on the features page.
If Zenmap cannot find nmap, reinstall with path registration left on. The 7.96 release also fixed a macOS case where Zenmap would not start when nmap was missing from PATH. Steps: Windows 11 install.
Changelog
OpenSSL 3.0.21 on all platforms. Included libssh2 patched and marked 1.11.1_NMAP1. Ncat HTTP proxy hang fixed. Zenmap profile editor no longer crashes on a percent sign in a saved command. Eight new DICOM NSE scripts, 620 total. A script that runs more than 5 seconds without yielding is killed, and allocations past 400 MB error. Libraries: libpcap 1.10.7, pcre2 10.49, Lua 5.4.9, libdnet 1.18.2. --stats-every works with --noninteractive.
New IPv4 and IPv6 OS fingerprints and many service fingerprints. OpenSSL 3.0.19, libpcap 1.10.6, libpcre2 10.47, liblinear 2.50, zlib 1.3.2. Bundled Npcap moved from 1.83 to 1.87. Zenmap shipped as a universal Python wheel. Windows scans can use OpenVPN TAP adapters. A reverse-DNS slowdown introduced in 7.98 was fixed.
Windows installer rebuilt with NSIS 3.11. OpenSSL 3.0.17 and Lua 5.4.8. Npcap 1.82 to 1.83 for PPPoE. Fixed macOS "dnet: Failed to open device en0" and a Zenmap crash, "ValueError: I/O operation on closed file", when Nmap itself fails.
Zenmap no longer crashes at scan start on Windows locales that use non-Latin character sets. The parallel forward resolver consults the hosts file and understands the name localhost. A sample malware URL was removed from http-malware-host example output.
OpenSSL 3.0.16, Lua 5.4.7, libssh2 1.11.1, libpcap 1.10.5, pcre2 10.45, libdnet 1.18.0. Npcap 1.79 to 1.82, with faster injection, VLAN header capture, and SR-IOV adapters. Forward DNS lookups became parallel. Nping's version number matches Nmap. Zenmap gained dark mode. TCP connect scans on Windows stopped marking closed ports as filtered. NSE count at that release: 612.
The project publishes file hashes and a detached signature for each release file. Compare the SHA-256 of your copy of nmap-7.991-setup.exe with this value before you run it. A match means the bytes are the published installer. It does not mean every antivirus product will stay quiet.
SHA-256 93BFD37B DB31A7AD FD932BEB 5DBCE060 25DA691D 01A0939E 806EA704 F7367657
Windows installers and executables are signed with an EV code-signing certificate issued to Insecure.Com LLC. Check that signer in the file properties after the hash matches. Source tarballs have their own hashes. Do not treat a hash from a random repost as the same check.
The usual hit is ncat.exe, not a hidden installer bundle. Ncat can open a remote shell, so some engines label that behavior as malicious. The project has called this a false positive and noted that shells such as PowerShell are not treated the same way.
On an older 7.91 installer, a public multi-engine report showed only a small number of engines flagging the file. Later installers picked up a Microsoft Trusted Source designation on that report. Still hash 7.991 yourself. Steps are in the antivirus guide.
