Two advisories for Nginx Proxy Manager: 2.16.0 affected, and there is no patch

Nginx Proxy Manager is the shortcut with which thousands of self-hosters and small company operations get TLS, vhosts and redirects working without nginx craftsmanship. On 29 September 2026 at 00:31 UTC two security advisories for it went out through GitHub Advisories in one batch: GHSA-pm9h-p429-j8c5 carries severity critical and describes the missing rate bound at the token endpoints, GHSA-886j-w36h-wmx2 high with directive injection through advanced_config. Both name the affected versions "through 2.16.0", re-checked over the registry API on 29 September. The version that would act as the fix is missing. There is nothing to update to.

Why the combination stings

The critical advisory is an reachability problem: a front-door proxy whose management API lets anyone walk through token guesses unchecked is as good as an open admin entrance once an attacker finds the console on the network. The injection advisory needs a signed-in user but then reaches deeper: whoever can write directives into the generated nginx configuration executes code in the container, and few setups give that container less than the docker socket. Together that means: one guessed account suffices for the machine, and the machine holds the private keys and the routing for everything behind it.

What remains until upstream ships a release

1. Reachability of the console is the lever. The admin page does not need a guest WLAN, not too much VPN, and certainly no public DNS name. Harden the network side first: internal address range, its own VLAN stretch or access over VPN with named accounts, no port forward onto the console.
2. Who is admin decides everything. On the unpatched level, every full-access account is de facto root on the proxy. Keep full-admin lists short, delete shared logins, issue API tokens only with the needed scope and named after their purpose.
3. Turn on visibility. Have the login and token endpoints logged, or counted in front. A brute force against an API without rate limiting is a slanted avalanche of lines in the log, before it was not.
4. A change plan for day X. As long as no patch is out, the image tag "latest" says nothing about these CVEs. Notice when the repo moves, and book an update window for the fix day instead of improvising in an emergency.

Measured on ours

Our instance stands on 2.16.0 and sits right in the affected range, container state measured on 29 September. Whether the console would be publicly reachable, we tested from outside: the usual DNS candidates for npm- and proxy-names under our domains all run into NXDOMAIN, the console hangs on the internal address. The fix that does not exist we cannot play, so the points above stay our operating routine. When you check your own instance, the first question is the same: where is the console reachable, and who is on the admin list?

Further sources

• GitHub advisory GHSA-pm9h-p429-j8c5, critical, token endpoints without rate limit
• GitHub advisory GHSA-886j-w36h-wmx2, high, directive injection via advanced_config
• jc21/nginx-proxy-manager, repo and release states
• Docker image jc21/nginx-proxy-manager