Nginx Proxy Manager v2.16.0 went out on 24 September, the first release since June. Two features lead it, both aimed at jobs that used to end in a shell session: a logs viewer in the UI, and per-path access lists in the Proxy Host modal, where a rule can now cover one location instead of the whole host.
The security half
The changelog’s more interesting section is the security one. A remote code execution fix gets seven words: “Changed order of escape to prevent RCE”. Two-factor QR codes now generate locally, so the secret never leaves your server. DNS provider credentials are wiped from disk after certbot runs, API tokens are invalidated whenever a password changes, and a failed nginx config is kept as a .conf.err file instead of disappearing. Denied requests now return 403 instead of a 404 that read like a missing page, and reuseport is enabled to cut packet drops under load.
The certbot catch
One note matters before you pull. Certbot was bumped to 5.8.0, and the release carries the project’s own caution that DNS plugins “may not work as expected” and could need dependency tweaks. The certbot page is where that gets unpicked, and the warning is aimed at setups that issue certificates through a DNS plugin. Those plugins keep moving otherwise: the release adds LWS and Tencent Cloud EdgeOne DNS support, refreshes the Timeweb and Azure ones, and fixes Tencent Cloud apex and wildcard issuance.
The rest of the changelog
The image underneath moves with it: OpenResty 1.31.1.1, certbot 5.8.0, s6 overlay 3.2.3.0, the last of which adds socket activation for podman setups. The release ships under the usual Docker Hub tags: latest, 2 and 2.16.0.
The odds and ends are the usual kind. Custom locations collapse into a filterable list in the proxy host editor, a fix lands for config changes that did not take effect, regenerate-config now uses the row’s own model and host type, the broken sorting in Audit Logs is gone, and a logged-in visit to the login page lands on the dashboard. Three new locales arrived (Azerbaijani, Ukrainian, Persian) with refreshes for German, Estonian and Turkish.
My read
This is the kind of release that is easy to skim and worth reading: a small feature pair that saves shell trips, a security list worth checking, and exactly one warning, written where nobody can miss it. The escape-order line is the one that reads strangest and matters most. If any certificate on the box comes from a DNS plugin, open the certbot page before the upgrade, not after.
Sources: the v2.16.0 release notes on GitHub; the project’s certbot documentation page