Nginx Proxy Manager 2.17 patches auth oracle, fixes SSL certificate leaks and DNS integrations

Nginx Proxy Manager, a web-based tool for managing Nginx reverse proxies without manual configuration editing, has released version 2.17 with substantial security and reliability improvements. The update adds rate limiting to authentication endpoints, tightens user permission scoping for proxy hosts, and patches an authentication oracle vulnerability that could allow attackers to validate certificate existence without proper credentials. It also fixes a critical privacy flaw where the certificate API previously exposed private certificate keys in responses.

SSL certificate handling receives multiple fixes: Nginx now reloads correctly after renewal, Certbot failure reasons display properly in the web interface rather than showing generic errors, and certificate details appear directly in proxy host tables. The release updates Certbot and multiple DNS provider integrations, adding Scaleway DNS while updating Hetzner, Infomaniak, Baidu, Akamai Edge DNS, and dns-multi plugins. However, EdgeDNS, Beget, and Infomaniak integrations introduce breaking changes that may require certificate recreation. Reverse proxy improvements preserve client ports in forwarded Host headers, fix disappearing access-list rules during configuration regeneration, and correctly apply per-host HSTS subdomain settings.

Security fixes and SSL infrastructure changes

• Authentication hardening: Rate limiting is now applied to authentication endpoints, user permissions for proxy hosts are more narrowly scoped, and certificate validation now requires authentication rather than allowing unauthenticated verification.
• API security fix: The certificate API no longer exposes private certificate keys in its responses, closing a significant information disclosure vector.
• Dependency remediation: Backend package updates address 15 of 16 reported security advisories, including a denial-of-service vulnerability in the body-parser package.
• Certbot and DNS provider updates: Scaleway DNS support is newly added, while Hetzner, Infomaniak, Baidu, Akamai Edge DNS, and dns-multi plugins are updated; EdgeDNS, Beget, and Infomaniak integrations carry breaking changes requiring potential certificate recreation.
• Reverse proxy reliability: Access-list rules and SSL settings no longer disappear during host configuration regeneration, client ports are preserved in forwarded Host headers, and HSTS subdomain settings apply per-host rather than globally.

Why it matters

For self-hosters and small infrastructure operators running Nginx Proxy Manager on Linux systems or containers, this release closes several exploitable security gaps that could compromise certificate privacy or enable brute-force attacks. The breaking changes in DNS provider integrations highlight the operational friction of maintaining Certbot-based automation, particularly for users of European providers like Hetzner and Infomaniak who will need to plan certificate migration work.