This release includes 2 security fixes for security teams reviewing exposed deployments.
Published 3mo
Media Servers
✓ No known CVEs patched
This release patches 2 known CVEs
Topics
ffmpeg
lightweight
local-storage
nvr
opensource
privacy
+1 more
video-surveillance
Affected surfaces
rbac
rce_ssrf
Summary
AI summaryUniversal Modal Portals render all modals at the document root, fixing mobile accessibility issues.
Full changelog
Release v1.17.0
🎨 UI, UX & Aesthetics
- Universal Modal Portals: Implemented a robust architecture using React Portals to render all modals at the document root.
- Resolves mobile accessibility issues where navigation menus appeared over modals.
- Ensures the modal backdrop consistently dims the entire screen, including sticky headers and sidebars.
- Improved Sidebar & User Profiles:
- Added support for User Avatars with a new upload system.
- Enhanced Sidebar styling with integrated user profiles and better visual hierarchy.
- Optimized Sidebar collapse/expand behavior for better navigation flow.
- Mobile First Responsiveness:
- Stacked Action Buttons: Footer buttons in modals now intelligently stack on mobile for easier touch interaction.
- Fluid Tabs: Settings tabs now support visible horizontal scrolling on small screens (e.g., iPhone SE).
- Adaptive Padding: Dynamic modal padding to maximize usable content area on small devices.
- Live View Polish:
- Prioritized motion activity indicators: Red alerts for motion/recordings now take visual precedence over other states.
- Enhanced camera cards with vibrant status borders and cleaner typography.
⚙️ Settings & User Management
- Redesigned Settings Page: Re-organized settings into logical, collapsible groups (Account, Storage, Notifications, Optimization) for a cleaner management experience.
- User Accounts & Profiles:
- New Profile Page (
/profile) allowing users to manage their personal information and security. - Avatar System: Introduced
Avatar.jsxcomponent and backend endpoints for custom profile pictures.
- New Profile Page (
- Optimization Controls: Exposed advanced engine tuning parameters (FPS throttling, resolution limits, and verbose logging) for fine-grained performance control.
🚀 Performance & Stability
- Background Media Processing: FFmpeg and ffprobe operations (thumbnail generation, stream probing) are now handled by FastAPI background tasks, preventing the API from blocking during heavy recording activity.
- Startup Reliability: Fixed backend crashes related to missing imports (os,
json) and improved error handling for camera stream connectivity. - Orphan Recording Recovery: Added a manual trigger in Settings to scan and recover recordings not indexed in the database.
🛡️ Security
- Strict SSRF Protection: Webhook URL validation now strictly blocks all private and reserved IPv4/IPv6 ranges (e.g.,
10.x,172.x,192.x) to protect internal networks. - Safe CORS Configuration: Standardized CORS middleware to use configurable environment-based origin allowlists instead of overly permissive wildcards.
🔧 Backend & Infrastructure
- Unified Versioning: Synchronized all service versions to
v1.17.0for consistent deployment tracking. - Docker Hardening: Updated
docker-compose.prod.ymlwith security environment variables and better volume management for avatars and media. - Database Resilience: Improved migration logic for handling schema updates across different deployment environments.
Released on: 2026-02-11
Security Fixes
- Strict SSRF protection blocks private/reserved IPv4/IPv6 ranges in webhook URLs
- Safe CORS configuration uses environment-based origin allowlists instead of wildcards
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About spupuz/VibeNVR
All releases →Related context
Related tools
Earlier breaking changes
- v1.28.3 Must update docker-compose.yml with TZ variable for all services
Beta — feedback welcome: [email protected]