Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Nginx Proxy Manager / v2.16.0

Nginx Proxy Manager v2.16.0

UPDATE_WITH_CARE

Security-related language in release notes; update after a backup if you are affected.

Published: 2026-09-24T09:59:08Z · GitHub release

Summary of changes

Warning Certbot has been updated. Exercise caution with this upgrade as your DNS plugins may not work as expected and require tweaks to dependencies. See the Certbot Doc for more info. ## New Features - Add a Logs viewer to the UI (thanks @carlosalbertorg) - Per-path access lists in Proxy Host modal (thanks @drakhaw) ## Changes - Add reuseport to improve performance and reduce packet drops (thanks @7heMech) - Update s6 overlay to support podman socket activation (thanks @fo5for) - Changed order of escape to prevent RCE (thanks @Yasha-ops) - Fix missing new on PermissionError so denied requests return 403, not 404 (thanks @timothestoifl24) - Fix Insufficient private key permissions (thanks @vgoer) - Use local QR code generation to prevent leaking 2FA keys to third-parties (thanks @vgoer) - Fix Tencent Cloud apex and wildcard certificate issuance (thanks @xzy103) …

Breaking changes

None detected by heuristics.

CVEs linked to this release

None linked from release notes or OSV fixed-in match.

Linked issues / PRs mentioned

not stated in release notes

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.