Question: Is Nginx Proxy Manager 2.14.0 affected by recent nginx/OpenResty CVEs?

Hi,

I would like to ask whether Nginx Proxy Manager 2.14.0 is affected by any of the recently published nginx/OpenResty-related CVEs below:

• CVE-2026-28753
• CVE-2026-27651
• CVE-2026-32647
• CVE-2026-27784
• CVE-2026-27654

From my local check inside the Nginx Proxy Manager container, running the following command:
docker exec -it npm-app-1 nginx -V

I can for example see the following:
nginx version: openresty/1.27.1.2

My question is therefore whether Nginx Proxy Manager 2.14.0, with its bundled OpenResty 1.27.1.2 / underlying nginx version, is considered affected by any of the CVEs listed above, and whether there is any plan to update the bundled web stack to a version containing the relevant fixes/backports.

I am not reporting a new vulnerability here, only asking for clarification on the security status of the currently shipped version.

Thanks!

Start with the reported docker exec -it npm-app-1 nginx -V output and the bundled OpenResty/nginx version in Nginx Proxy Manager 2.14.0. Compare that version with the five listed CVE advisories and document whether it is affected, including any relevant fixes or backports and the status of an update plan.