Nginx Proxy Manager 2.15 has been released as a major maintenance update for the popular self-hosted Docker-based reverse proxy management tool, bringing a new Debian 13 “Trixie” base image.
A key change in this release is the OpenResty update, which addresses CVE-2026-42945, CVE-2026-8711, and CVE-2026-9256. Because OpenResty is part of the runtime stack, this update is especially important for public-facing deployments.
The release also improves Certbot handling, as the Certbot DNS plugin installations are now tested in CI, though actual certificate requests with these plugins are not.
Additionally, Nginx Proxy Manager 2.15 adds new Certbot plugins for hoster.by, RcodeZero, and Hostinger. The deSEC and EuroDNS plugins have also been updated, giving users more options for DNS-based certificate validation.
A security fix addresses an issue where any authenticated user could modify their own roles field through a PUT request. In multi-user Nginx Proxy Manager installations, this correction is important because role handling directly affects application permissions.
The web UI also receives several minor improvements. Nginx tables now support column sorting, proxy host delete confirmation dialogs display host information, and access list clients are inserted in order.
For Docker deployments, images are available under the latest, 2, and 2.15.0 tags. Users looking for controlled upgrades should pin the 2.15.0 tag instead of using latest, especially for production or remote self-hosted environments.
For additional details, visit the changelog.
The maintainers warn that this is a major update due to changes in the Debian base image. Users who rely on DNS validation plugins for Let’s Encrypt certificates should test the upgrade carefully, as some plugins may require dependency adjustments after the stack update.
