Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

NginxProxyManager/nginx-proxy-manager

              develop @ 5e6c53f
            

Fixes

CVEs

CRITICAL

Peak severity

28.6%

Coverage

Highlights

Auth Bypass: 11 prior fixes. Scrutinize any change in this area.

backend/internal/certificate.js: most-fixed (4 issues). Treat as high-risk during review.

18 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple fixes address inconsistent handling of Authorization header and deny-all rules, indicating a fragile template logic that can be bypassed via conditional misconfiguration.

Command Injection: Multiple fixes for shell command injection in certificate provisioning, involving DNS credentials and domain names, indicating a high-risk area where escaping and validation were repeatedly insufficient.

Auth Bypass: Two fixes for 2FA bypass: one for backup code validation, one for missing authorization checks on 2FA operations. This indicates a critical authentication surface with multiple bypass vectors.