Skip to content

spupuz/VibeNVR

v1.17.0 Security

This release includes 2 security fixes for security teams reviewing exposed deployments.

Published 3mo Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 2 known CVEs

Topics

ffmpeg lightweight local-storage nvr opensource privacy
+1 more
video-surveillance

Affected surfaces

rbac rce_ssrf

Summary

AI summary

Universal Modal Portals render all modals at the document root, fixing mobile accessibility issues.

Full changelog

Release v1.17.0

🎨 UI, UX & Aesthetics

  • Universal Modal Portals: Implemented a robust architecture using React Portals to render all modals at the document root.
    • Resolves mobile accessibility issues where navigation menus appeared over modals.
    • Ensures the modal backdrop consistently dims the entire screen, including sticky headers and sidebars.
  • Improved Sidebar & User Profiles:
    • Added support for User Avatars with a new upload system.
    • Enhanced Sidebar styling with integrated user profiles and better visual hierarchy.
    • Optimized Sidebar collapse/expand behavior for better navigation flow.
  • Mobile First Responsiveness:
    • Stacked Action Buttons: Footer buttons in modals now intelligently stack on mobile for easier touch interaction.
    • Fluid Tabs: Settings tabs now support visible horizontal scrolling on small screens (e.g., iPhone SE).
    • Adaptive Padding: Dynamic modal padding to maximize usable content area on small devices.
  • Live View Polish:
    • Prioritized motion activity indicators: Red alerts for motion/recordings now take visual precedence over other states.
    • Enhanced camera cards with vibrant status borders and cleaner typography.

⚙️ Settings & User Management

  • Redesigned Settings Page: Re-organized settings into logical, collapsible groups (Account, Storage, Notifications, Optimization) for a cleaner management experience.
  • User Accounts & Profiles:
    • New Profile Page (/profile) allowing users to manage their personal information and security.
    • Avatar System: Introduced Avatar.jsx component and backend endpoints for custom profile pictures.
  • Optimization Controls: Exposed advanced engine tuning parameters (FPS throttling, resolution limits, and verbose logging) for fine-grained performance control.

🚀 Performance & Stability

  • Background Media Processing: FFmpeg and ffprobe operations (thumbnail generation, stream probing) are now handled by FastAPI background tasks, preventing the API from blocking during heavy recording activity.
  • Startup Reliability: Fixed backend crashes related to missing imports (os, json) and improved error handling for camera stream connectivity.
  • Orphan Recording Recovery: Added a manual trigger in Settings to scan and recover recordings not indexed in the database.

🛡️ Security

  • Strict SSRF Protection: Webhook URL validation now strictly blocks all private and reserved IPv4/IPv6 ranges (e.g., 10.x, 172.x, 192.x) to protect internal networks.
  • Safe CORS Configuration: Standardized CORS middleware to use configurable environment-based origin allowlists instead of overly permissive wildcards.

🔧 Backend & Infrastructure

  • Unified Versioning: Synchronized all service versions to v1.17.0 for consistent deployment tracking.
  • Docker Hardening: Updated docker-compose.prod.yml with security environment variables and better volume management for avatars and media.
  • Database Resilience: Improved migration logic for handling schema updates across different deployment environments.

Released on: 2026-02-11

Security Fixes

  • Strict SSRF protection blocks private/reserved IPv4/IPv6 ranges in webhook URLs
  • Safe CORS configuration uses environment-based origin allowlists instead of wildcards

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track spupuz/VibeNVR

Get notified when new releases ship.

Sign up free

About spupuz/VibeNVR

All releases →

Related context

Earlier breaking changes

  • v1.28.3 Must update docker-compose.yml with TZ variable for all services

Beta — feedback welcome: [email protected]