bunkerweb

Documentation : https://docs.bunkerweb.io/1.6.12/

Docker tags :

• All-in-one : bunkerity/bunkerweb-all-in-one:1.6.12 or ghcr.io/bunkerity/bunkerweb-all-in-one:1.6.12
• BunkerWeb : bunkerity/bunkerweb:1.6.12 or ghcr.io/bunkerity/bunkerweb:1.6.12
• Scheduler : bunkerity/bunkerweb-scheduler:1.6.12 or ghcr.io/bunkerity/bunkerweb-scheduler:1.6.12
• Autoconf : bunkerity/bunkerweb-autoconf:1.6.12 or ghcr.io/bunkerity/bunkerweb-autoconf:1.6.12
• UI : bunkerity/bunkerweb-ui:1.6.12 or ghcr.io/bunkerity/bunkerweb-ui:1.6.12
• API : bunkerity/bunkerweb-api:1.6.12 or ghcr.io/bunkerity/bunkerweb-api:1.6.12

Linux packages : https://packagecloud.io/app/bunkerity/bunkerweb/search?q=1.6.12&filter=all&dist=

Changelog :

v1.6.12 - 2026/06/??

Security

• nginx: updated NGINX to 1.30.3 to fix:

  • CVE-2026-42055: heap buffer overflow in ngx_http_proxy_v2_module / ngx_http_grpc_module
  • CVE-2026-48142: heap buffer overread in ngx_http_charset_module

• api: hardened Biscuit token generation by binding Host header, client IP and username as typed terms, preventing signed Datalog fact injection. Added optional API_ALLOWED_HOSTS.

• api: API_ACL_BOOTSTRAP_FILE now validates supplied bcrypt hashes and rejects weak or malformed values.

• antibot: Cap.js challenge now uses a strict per-request CSP nonce and sends Cache-Control: no-store.

• antibot: fixed an open redirect in the post-challenge redirect flow by enforcing same-origin relative paths.

• ui: fixed session fixation on login by rotating the session ID on every authentication.

• ui: fixed open redirect via the post-login next parameter.

• ui: password changes now revoke the user’s other active sessions.

• ui: cache deletion routes now enforce Biscuit authorization.

• ui: improved hostname and ban-scope validation.

• ui: extended CSV/XLSX formula-injection protection to tab and carriage-return-prefixed cells.

• linux: uninstall hooks now preserve logs, configs, databases and backups unless purge is explicitly requested; upgrade backups moved to /var/backups/bunkerweb.

Features & Improvements

• reverseproxy: added upstream HTTPS certificate verification with:

  • REVERSE_PROXY_SSL_VERIFY
  • REVERSE_PROXY_SSL_VERIFY_DEPTH
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_DATA
  • REVERSE_PROXY_SSL_TRUSTED_CERTIFICATE_PRIORITY

• antibot: ANTIBOT_IGNORE_URI can now match full request URIs, including query strings.

• scheduler: added SCHEDULER_MAX_WORKERS to cap the job-executor thread pool and reduce database pool pressure.

• ui: ADMIN_PASSWORD can now accept pre-hashed bcrypt values.

• ui: logs viewer overhaul:

  • syntax highlighting for BunkerWeb, certbot and NGINX access logs
  • severity filters with counts
  • in-page search and error navigation
  • live-tail with pause and new-line indicator
  • download/copy actions
  • optional local-time display
  • collapsible multi-line entries
  • improved mobile toolbar layout

• ui: RAW config editor can now fold multi-line file settings, such as certificates and keys.

• mtls: added MTLS_URL_n regex setting to enforce mTLS per path instead of site-wide.

• bunkernet UI: improved status reporting with Connected / API unreachable / Not registered states, masked instance ID and disk self-heal.

Bug Fixes

• letsencrypt: fixed cache poisoning that could cause fleet-wide certbot AccountNotFound.
• letsencrypt: fixed scheduler/UI cache-row write race by sharing one fcntl.flock.
• letsencrypt: fixed Route53 auto-renewal when explicit AWS credentials are used.
• letsencrypt: fixed stale ACME account recovery when LETS_ENCRYPT_CONCURRENT_REQUESTS=yes.
• letsencrypt UI: deleting a certificate no longer fails when unrelated orphaned certificates are present.
• antibot: after solving a challenge, Chrome now returns to the originally requested URL instead of /.
• api: malformed API_ALLOWED_HOSTS wildcards no longer brick the API on every request.
• datastore: changing DATASTORE_LRU_SIZE no longer causes worker API HTTP 444 bootstrap deadlocks.
• database: fixed rc1 regression that reset UI/API-saved settings to defaults after scheduler restart.
• database: env vars no longer stay shadowed after a setting was touched in the UI/API.
• database: multisite env settings for DB-created services are no longer dropped as unknown globals.
• ssl: SSL_ECDH_CURVE=auto no longer emits X25519 on FIPS OpenSSL.
• autoconf: service labels are rechecked when valid settings change, such as after PRO plugin or external plugin installation.
• logger: unreachable LOG_SYSLOG_ADDRESS no longer crash-loops scheduler and UI processes.
• installer: testing/dev install script is now idempotent and avoids duplicating force-bad-version.
• ci: Testing release install script now defaults to the testing channel.
• ui: Setup Wizard now shows a Log Out button when reached while already authenticated.
• ui: RAW mode no longer breaks multi-line file settings such as PEM certificates and keys.
• ui: /home, /reports and /bans load much faster on Redis-backed setups.
• ui: static assets no longer trigger the full per-request lifecycle.
• ui: form-builder no longer creates phantom method=ui rows on no-op saves.
• ui / api: fixed possible login lockout with bcrypt 5.0.0 and passwords over 72 bytes.
• ui: fixed dark/light theme flicker and wrong-theme-on-load.
• ui: fixed plugin metrics crashes on Redis-backed setups.
• limit: fixed spurious HTTP/3 429 responses by separating HTTP/1, HTTP/2 and HTTP/3 connection limits.
• customcert: expired or soon-to-expire custom certificates are now accepted if they are valid X.509 certificates.

Linux & Packaging

• Fedora 43 and 44 now use NGINX 1.30.3.
• Ubuntu Pro/ESM installs now use the upstream CrowdSec engine instead of the outdated ESM build.
• Added Ubuntu 26.04 Resolute Raccoon package target.
• Ubuntu 24.04 Noble moved to the ubuntu-noble identifier.
• Ubuntu 22.04 Jammy remains available as ubuntu-jammy.

Dependencies

• Updated headers-more-nginx-module to 0.40.

• Updated lua-cjson to 2.1.0.18.

• Updated lua-resty-signal to 0.05.

• Updated lua-resty-string to 0.19.

• Updated lua-upstream-nginx-module to 0.08.

• Updated LuaJIT to 2.1-20260701.

• Updated ModSecurity to 3.0.16.

• Updated lua-resty-openssl to 1.8.0.

• Updated coreruleset-v4 to 4.27.0.

• Updated UI dependencies:

  • jQuery 4.0.0
  • Bootstrap 5.3.8
  • DataTables 2.3.8
  • Ace editor 1.44.0
  • ApexCharts.js 5.15.0
  • DOMPurify 3.4.11
  • i18next 26.3.1
  • i18next-http-backend 4.0.0
  • Perfect Scrollbar 1.5.6
  • lottie-player 2.0.12
  • canvas-confetti 1.9.4
  • ipaddr.js 2.4.0

• Updated build tooling:

  • cssnano 8.0.2
  • domino 2.1.7
  • removed unused root jquery dependency

Contributions

• Thanks to @Cleverguns for the Filipino / Tagalog web UI translation.
• Thanks to @ray910408 for refreshing src/deps npm build-tool dependencies.
• Thanks to @immanuwell for parsing the DEBUG environment variable as a boolean in the Gunicorn configuration.