Skip to content

spupuz/VibeNVR

v1.27.0 Security

This release includes 3 security fixes for security teams reviewing exposed deployments.

Published 1mo Media Servers
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 3 known CVEs

Topics

ffmpeg lightweight local-storage nvr opensource privacy
+1 more
video-surveillance

Summary

AI summary

VibeNVR v1.27.0 introduces hardware-first motion detection, high-fidelity live audio, and deep camera metadata retrieval.

Full changelog

Full Changelog: https://github.com/spupuz/VibeNVR/compare/v1.26.0...v1.27.0

🚀 Release v1.27.0: The Hardware-First Revolution

📝 Summary

VibeNVR v1.27.0 shifts the paradigm from software-heavy processing to Hardware-First Intelligence. By offloading motion detection and metadata extraction to the cameras themselves, we've achieved unprecedented performance levels. This release also introduces high-fidelity Live Audio and a sophisticated PTZ engine, making VibeNVR a world-class professional monitoring solution.

🛠️ Key Technical Pillars

🏃 ONVIF Edge Motion (Zero-CPU Detection)

Instead of using the NVR's CPU to analyze pixels, VibeNVR now natively supports ONVIF PullPoint events.

  • Efficiency: Motion detection is handled by the camera's internal AI/Chipset.
  • Rising-Edge Logic: A new "smart notification" system ensures the NVR is only alerted on state changes, eliminating network flooding.
  • Reliability: An "Auto-Rebind" pattern automatically repairs lost subscriptions every 4 minutes, ensuring you never miss an event.

🔊 High-Fidelity Live Audio

We've integrated a professional-grade audio pipeline using the browser's native WebCodecs API.

  • Ultra-Low Latency: Direct PCM (ALAW/ULAW) decoding for real-time sound.
  • Non-Blocking Architecture: Audio and Video streams are now independent. If the audio encounters a glitch, the video continues to play smoothly without any freezing.
  • Full Control: Integrated PTZ-linked audio toggles with smart-resumption logic.

🔍 Deep Camera Information Retrieval

VibeNVR now goes beyond simple video feeds, acting as a full Asset Management tool.

  • Metadata Extraction: Automatically retrieve technical details from your cameras, including Manufacturer, Model, Firmware Version, Serial Number, and Hardware ID.
  • Persistence: This data is stored in the database and visible in the UI, making it easier to manage large fleets of heterogeneous cameras (e.g., Tapo, Hikvision, Dahua).

🕹️ Advanced PTZ & Intelligent Home

Control your cameras with surgical precision.

  • 3-Stage Smart Home: If your camera lacks a native "Home" button, VibeNVR automatically implements one using a fallback system (Native Command → Existing Preset → On-the-fly Preset Creation).
  • Mobile Precision: Unified PointerEvents provide a "joystick-like" feel on smartphones, eliminating the lag and "sticky" controls typical of mobile NVRs.
  • Capability Detection: The UI intelligently hides buttons that your hardware doesn't support (Zoom, Pan, Tilt), keeping the interface clean and relevant.

🛡️ Security & Integrity

  • Log Redaction: Automatic masking of sensitive RTSP/ONVIF credentials in all logs.
  • Privacy Masking: Forced transcoding when masks are active to ensure privacy cannot be bypassed.
  • RBAC Audit: Verified 100% compliance with Viewer/Admin role isolation.

✅ Verification

  • Test Suite: 26/26 Deep Assurance tests passed.
  • Performance: Validated 90% reduction in motion-event network noise.

Security Fixes

  • Log redaction automatically masks sensitive RTSP/ONVIF credentials
  • Privacy masking enforces transcoding to prevent bypass of privacy regions
  • RBAC audit verified 100% compliance with Viewer/Admin role isolation

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track spupuz/VibeNVR

Get notified when new releases ship.

Sign up free

About spupuz/VibeNVR

All releases →

Related context

Earlier breaking changes

  • v1.28.3 Must update docker-compose.yml with TZ variable for all services

Beta — feedback welcome: [email protected]