Skip to content

spupuz/VibeNVR

v1.16.2 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 3mo Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

ffmpeg lightweight local-storage nvr opensource privacy
+1 more
video-surveillance

Affected surfaces

auth

Summary

AI summary

Camera health monitoring with real‑time alerts and credential scrubbing in notifications.

Full changelog

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.16.1...v1.16.2

v1.16.2 - Health Notifications & Security Improvements

✨ New Features

Camera Health Monitoring

  • Real-time Health Status Detection: Engine now monitors camera connectivity and authentication status in real-time
  • Immediate Notifications: Get instant alerts when cameras go offline or have authentication issues
  • Recovery Alerts: Receive notifications when cameras come back online (✅ Camera Recovered)

Polished Notification Messages

  • Health status notifications now include emojis for better visibility:
    • 🚫 Camera Authentication Failed - Wrong password/credentials
    • 📡 Camera Offline - Network unreachable
    • Camera Recovered - Camera back online
  • User-friendly error messages replace raw technical output

Notification Debouncing

  • Alerts are sent only when camera status changes, preventing notification spam
  • Single notification per status change (problem detected → problem resolved)

Per-Camera Health Notification Settings

  • Configure separate notification channels for health events vs motion events
  • Individual Telegram, Email, and Webhook settings for health alerts
  • Global settings fallback when camera-specific settings are not configured

Test Notification Buttons

  • Added "Test" buttons for all notification types in Camera Edit modal
  • Standardized button styling across Email, Telegram, and Webhook tests
  • Supports partial override (e.g., Camera Recipient + Global SMTP)

🐛 Bug Fixes

  • Fixed AttributeError: 'StreamReader' object has no attribute 'last_health_report_status'
  • Fixed duplicate <button> tags in Cameras.jsx causing syntax errors
  • Improved 401/403 authentication error detection with curl fallback
  • Fixed StreamReader callback not triggering for UNAUTHORIZED status

🔒 Security Improvements

  • Credential Scrubbing: Sensitive RTSP credentials (username/password) are now sanitized from all notification messages
  • Debug Script Removal: Removed insecure backend/debug_conn.py that could expose credentials
  • URL sanitization: Double slashes in RTSP paths are now properly cleaned

🎨 UI Improvements

  • Removed redundant "NO SIGNAL" and "INVALID PASSWORD" text overlays from LiveView (status badges already show this info)
  • Added invalid-password.png placeholder image for authentication errors
  • Consistent "Test" button styling with bordered design, hover effects, and shadows

📁 Files Changed

New Files

Modified Files

Security Fixes

  • Sensitive RTSP credentials are now sanitized from all notification messages
  • Removed insecure backend/debug_conn.py script that could expose credentials

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track spupuz/VibeNVR

Get notified when new releases ship.

Sign up free

About spupuz/VibeNVR

All releases →

Related context

Earlier breaking changes

  • v1.28.3 Must update docker-compose.yml with TZ variable for all services

Beta — feedback welcome: [email protected]