Nginx Proxy Manager, an open-source tool that provides a web-based interface for managing Nginx reverse proxies, SSL certificates, and access controls without manually editing configuration files, has just released version 2.17.
On the security side, authentication endpoints now have rate limiting, and user permissions for proxy hosts are more tightly scoped. The update also fixes an authentication oracle vulnerability and requires authentication before certificates can be validated.
Another fix prevents the certificate API from exposing private certificate keys in its responses. In addition, refreshed backend packages address 15 of 16 reported security advisories, including a denial-of-service vulnerability affecting the body-parser package.
SSL certificate management also receives several fixes. Nginx now reloads correctly after certificate renewal, and when Certbot encounters a problem, the web interface displays the actual failure reason instead of a generic “Internal Error” message. Plus, certificate details are now visible directly in proxy host tables.
The release also updates Certbot and several DNS provider integrations. Scaleway DNS support has been added, while Hetzner, Infomaniak, Baidu, Akamai Edge DNS, and dns-multi plugins have been updated.
However, the developers warn that the Certbot update may require adjustments to existing DNS plugin dependencies. The EdgeDNS, Beget, and Infomaniak integrations introduce breaking changes. Users relying on these providers are advised to consider recreating their DNS-based SSL certificates and removing the old ones.
On the reverse proxy side, version 2.17 fixes an issue where access-list rules and SSL settings could disappear when host configurations were regenerated. It preserves client ports in forwarded Host headers and correctly applies HSTS subdomain settings individually for each host.
Several smaller improvements address day-to-day administration. The UI now helps prevent accidental loss of unsaved form changes, and the dark theme has updated colors following changes to the Tabler framework.
Finally, the release updates s6-overlay to version 3.2.3.2, removes stale Nginx PID files before startup, and includes several translation updates.
For more information, see the changelog.
