NPMplus

v2026-04-21-r2 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Reverse Proxies & Load Balancers

✓ No known CVEs patched

This release patches 1 known CVE

Topics

nginx nginx-php nginx-proxy nginx-proxy-manager nginx-reverse-proxy npmplus

Summary

AI summary

Removed AUTH_REQUEST_TINYAUTH_DOMAIN env var; tinyauth v5.0.7+ now required; cookie names changed.

Full changelog

support voidauth
remove AUTH_REQUEST_TINYAUTH_DOMAIN env, tinyauth v5.0.7+ is now required
allow the backend to send all Upgrade headers again, if you have issues with apple clients try to instead disable http2 in your upstreams
cookies are more strict now, the cookie name has changed because of this
always send "Origin-Agent-Cluster: ?1" header
hsts buttons are now better labeled
CERTBOT_RUN_INTERVAL is now limited to 500 hours
inbuilt php has been fixed
the error log written to disk now uses error level info
rename the advanced tab from a cogwheel symbol to advanced
show a star if a custom config is set for locations
dep and doc updates

Full Changelog: https://github.com/ZoeyVid/NPMplus/compare/2026-04-21-r1...2026-04-21-r2

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track NPMplus

Get notified when new releases ship.

About NPMplus

a fork of nginx-proxy-manager