NeXroll 2.2.7 is a security update. Anyone who could reach a NeXroll install could download files from it, its database included, and while login was off, other websites could use NeXroll through your browser. Please update soon, especially on Docker. It also brings length filters and one row per preroll to Community Prerolls, themes that recolor the whole app, and a Windows installer on Python 3.14.
Upgrading
- Your data carries over. New settings are added on first start.
- Windows: run the installer over your existing install. It needs Windows 10 or 11 (64-bit).
- Docker:
jbrns/nexroll:latest,:2.2and:2, and the same tags onghcr.io/jflxcloud/nexroll, are 2.2.7. - Jellyfin and Emby: no plugin update is needed; 1.14.1.0 (Jellyfin 10.11 and Emby) and 1.15.1.0 (Jellyfin 12) are current.
- Password reset works only sent straight to
http://localhoston the NeXroll machine, as the sign-in screen shows; through a reverse proxy or tunnel it is refused. - Docker PUID and PGID take effect only with
NEXROLL_RUN_AS_PUID=true(Unraid: Run as PUID/PGID). Without it, nothing changes.
Security
- Files could be downloaded without logging in. The links the Jellyfin and Emby plugins stream prerolls from were signed with a key anyone could work out (the same on every Docker install), and the route that serves them accepted any file. Anyone who could reach NeXroll could download, for example, its database, which holds your Plex token and server keys, even with login on. Each install now has its own random key, and only videos are served. Affects 1.12.0 through 2.2.6.
- Jellyfin and Emby plugin setup didn't require login. Anyone who could reach NeXroll could point the plugin at another server and collect a new API key. Setup now needs a signed-in user; the routes the plugins use are unchanged.
- Other websites could use NeXroll through your browser while login was off. NeXroll now answers other sites only on the plugin routes and the API-key
/external/routes, and refuses changes a browser marks as coming from another site. Scripts, dashboards that call/external/with a key, and the plugins are not affected. - Password reset and the local admin shortcuts trusted requests relayed by a reverse proxy or tunnel on the same machine. They now accept only requests sent straight to localhost.
- The current-preroll preview could play any video on the machine by its path. It now plays only the files NeXroll lists.
- Updated components. The Windows installer moves from Python 3.10.11, which no longer receives fixes, to 3.14, with updated libraries. The Docker image patches basic-ftp (CVE-2026-102990) in the YouTube PO-token provider and takes Deno from its official image instead of an install script.
Community Prerolls
Browse and Search filter by length, with presets or a custom range, and sort shortest or longest first. Lengths are read from the files themselves in the background after an index build. The Plex, Jellyfin and Emby versions of a preroll are now one row with a chip per version: the download dialog ticks the versions for the servers you have connected, and previews switch between them. Search lists direct matches first, the same file stored in two folders shows once, titles are tidier, an index older than a week keeps working while it asks for a refresh, and an optional weekly refresh keeps it current. See Community Prerolls.
Themes
Every theme now recolors the whole app, section colors, buttons and sidebar included, instead of leaving parts of it in the default colors.
Docker
The container can run as a non-root user: set NEXROLL_RUN_AS_PUID=true with PUID and PGID, and NeXroll gives that user the files it created as root before starting as it. Images are also tagged with their minor and major version (2.2, 2) (#46). See Docker.
The full list is in the changelog.