Hi NodeBB Team, I updated my NodeBB instance to v4.14.9 yesterday and immediately noticed a critical issue with user registration: completing the registration process fails with an invalid csrf token / Forbidden error on POST /register/complete. To ensure it wasn't a server-side configuration issue on my end, I performed the following troubleshooting steps: Verified config.json has "trust_proxy": true and correct HTTPS URL. Verified Nginx configuration includes proxy_set_header X-Forwarded-Proto $scheme; and all required WebSocket headers. Completely disabled spam and CAPTCHA plugins (e.g., nodebb-plugin-spam-be-gone). Tested across clean browser profiles / Incognito windows. Crucial detail: I attempted to register a new account on community.nodebb.org as well, and encountered the exact same "Forbidden" / CSRF failure upon completing registration. It seems a session/CSRF token validation issue was introduced in this release affecting the registration flow. Could you please look into this or confirm if a patch is coming? Thanks! [image: 1786424116011-img_8576.png] @baris @julian

At my docker log, when searching chat messsage, it will prompt the following deprecated message. But this didn't happen when search post/topics. Please update the hooks. 2026-08-07T01:21:25.452031574Z 2026-08-07T01:21:25.451Z [4567/3231] - warn: [deprecated] 2026-08-07T01:21:25.452074545Z at SocketModules.chats.searchMessages (/usr/src/app/src/socket.io/modules.js:188:10) 2026-08-07T01:21:25.452079254Z at Callbackified (node:util:412:5) 2026-08-07T01:21:25.452082069Z at wrapperCallback (/usr/src/app/src/promisify.js:44:12) 2026-08-07T01:21:25.452084562Z use GET /api/v3/search/chats/:roomId/messages

The last breaking change post by @baris is from here My plugins were adapted to the changes mentioned there and didn't review again through out 4.14.x. Just want to know up until 4.14.9, any other breaking change so that I need to look into the plugin again? Also, can dev help to remediate this deprecate message issue? https://community.nodebb.org/topic/19417/deprecated-message-when-search-chat-messages

Hi @baris , I was able to upgrade to 4.14.7, but I'm unable to run ./nodebb build due to the following error: ERROR in ./node_modules/bootstrap/dist/js/bootstrap.esm.js + 57 modules Unexpected end of JSON input I tried removing the node_modules directory and installing npm, but the issue persists. Any idea how to fix it?

The widget is displayed, sometimes in Hebrew and sometimes in English. A bit strange and unclear.

Some language were missing after updated [image: 1783651529110-1eafa332-ce78-4584-b964-00e86f4e574c-image.jpeg] [image: 1783651548955-280a053d-5fd0-43c4-badf-824830150072-image.jpeg]

It would be useful if there was a way to give permission to edit a post with one click to an entire group. Currently, you have to select the members one by one. I mean the groups that are built into the forum or added by the administrators. The correct way to implement this in my opinion is a drop-down filter list like the one currently shared by users and groups, and saving a key of groups that are allowed to edit. I could open a PR if this feature is accepted into the core. If I don't do it as an add-on

2 plugin related to Nodebb search capability: Meilisearch plugin (@jasonwch/nodebb-plugin-meilisearch-r) : https://github.com/jasonwch/nodebb-plugin-meilisearch-r The original Meilisearch plugin haven't been updated for a year and that is not compatible with current NodeBB 4.14.x release, bugs / ACP interface / outdated MS JS API library...etc I've made this refactored version which remediate the bugs/GUI issues I faced. Bonus: revamped the compose title suggestion style. [image: 1785995603495-a49707c1-75b8-4999-a01f-d2bfc0d7a5cf-image.jpeg] Topic Search button (nodebb-plugin-topic-search-button) : https://github.com/jasonwch/nodebb-plugin-topic-search-button Adds a 'Search in topic' button to the topic toolbar that pre-fills the search box with the in:topic- prefix. NodeBB has embedded search function to search posts within the topics, but it only support using keyboard hotkey to trigger. However, the keyboard hotkey may mask by some browsers. This plugin adds a 'Search in topic' button to the topic toolbar that pre-fills the search box with the in:topic- prefix. [image: 1785995662081-5faa1f8c-dff6-444b-bf53-d34f80886df9-image.jpeg]

Is there any way to tweak the existing search feature to search everywhere and not only in topics, posts,..? I'm experiencing a lot of users that do not found what they are looking for because the search seam to be not that intuitive Thanks a lot!

Hi, reporting an RTL bug on my forum When tagging a user for example @julian If there is no text on the same line, the RTL is used and written from left to right. If there is text on the same line, then the line is right-aligned as it should be. Hope I understood.

translation missing -> [[global:former-user]] [image: 1785986051870-314420ce-e838-4cee-9357-b5a844785946-image.jpeg]

Install: nodebb-plugin-attachment-privileges Restrict attachment downloads based on category Access Topics privilege https://github.com/jasonwch/nodebb-plugin-attachment-privileges

My forum had a second account with admin rights, as a back up. Trying to remove admin rights sends me into a constant loop of asking to log in again. Says this action needs re-authenticating over and over?

Hi @baris , Scenario : I have one web application in next.js in front end and node.js in backend. It has courses, text, Users, etc. We use SSO for the same in web application and in NodeBB. Now our NodeBB (Forum) i need to integrate with my web application. After searching i come to this point is that we can use endpoint API to create frontend in my web application. Could you please tell me can we integrate this? Where i can find the list of all Endpoints API? Is this better way ? or we can do custom modifications in frontend and try to make similar look of current web application ? which is better?

Today I found that the link preview disappeared. However, if I check "Youtube" the preview for Youtube works

Hello Everyone, The upcoming 4.14.0 release will have breaking changes for themes and plugins that display html and translation tokens via template variables. This post will outline the changes required to custom themes based on the changes made in the Harmony theme to serve as a guide for upgrading your own themes & plugins. 1. Escape all template variables via {variable} The first and biggest change is the introduction of html and translation escaping of all variables in templates. Prior to 4.14.0 if you wrote {variable} in a template the value would be inserted into the html page unchanged. Benchpressjs supports escaping these variables but it was disabled to prevent a breaking change when the migration was done from templates.js to benchpressjs. We are now aligning with how most template engines work. What this means for themes is if variable contained html then it will no longer be displayed properly. For example the content of posts is rendered via {posts.content} in partials/topic/post.tpl. Upgrading to 4.14.0 without fixing the template would result in: [image: 1781913742447-blog-1.png] To fix this in 4.14.0, you will have to wrap the variable with double braces like {{posts.content}}. This will stop the escaping and the post content will display properly. Double braces should only be used on content that is html sanitized. In this case NodeBB converts markdown to html and sanitizes it so it is safe. Do not use {{variable}} syntax on untrusted content. The {{}} syntax should also be used on all helper functions that return html. For example buildAvatar function return html to display the user icon or picture. So {buildAvatar(user, "24px", true)} should be changed to {{buildAvatar(user, "24px", true)}}. We've updated all these helpers to escape the values and attributes used. If you have custom helpers you should do the same. Below is an example of a helper that is used in header.tpl. It uses the same escape function that {variable} uses. function buildMetaTag(tag) { const name = tag.name ? `name="${escape(tag.name)}" ` : ''; const property = tag.property ? `property="${escape(tag.property)}" ` : ''; const content = tag.content ? `content="${escape(tag.content).replace(/\n/g, ' ')}" ` : ''; return '<meta ' + name + property + content + '/>\n\t'; } Refer to section 3, for a full list of changes that were made to Harmony theme to upgrade it to 4.14.0. 2. Migration to tx() and txEscape() helper functions This is the second major change, and we're introducing it as part of an ongoing upgrade process to help avoid creating too much work for theme maintainers at once. The way translation works in NodeBB is through a post render step. After benchpressjs renders the template and generates the html page, our translator scans the html page and replaces translation tokens that look like [[namespace:key]] with their correct translation. Here is roughly how it goes from request to final html presented to user. User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Translator escapes the html from step 3, so tokens in the post content don't get translated Benchpress renders the html filling in all data Translator scans html replacing translation tokens with their translations Translator unescapes the result (reverses step 4) Final html sent to user With the introduction of a helper function tx() instead of scanning the entire page, we can use the helper to translate tokens. For example instead of <button>[[topic:reply]]</button> we can use <button>{{tx("topic:reply")}}</button>. This approach is more efficient because only the translation tokens are processed. With 4.14.0 we will still run the whole page translation to make migration easier, but for 4.15.0 we are going to remove that step, so the entire flow will be: User requests /topic/1 Load all required data from database Call filter:parse.post to turn post markdown into html Benchpress renders the html, calls tx() to translate tokens Final html sent to user We are introducing 2 new helper functions for templates: tx() - translates the string or array passed in. This supports a variety of different usages: Old New [[namespace:key]] {{tx("namespace:key")}} [[namespace:key, foo]] {{tx("namespace:key", "foo")}} [[namespace:key, {arg1}, {arg2}]] {{tx("namespace:key", arg1, arg2)}} {text} {{tx(text)}} You can also pass an array to the tx() helper. For example if you have: const myVar = ["namespace:key", "arg1", "arg2"]; This can be passed straight to tx in the template {{tx(myVar)}} tx helper html escapes arguments and invalid translation keys. txEscape() - escapes variable so it is not translated. This is a stop-gap solution until we remove the whole page translation. For example we use this on content that should not be translated. If someone puts [[namespace:key]] in their post it doesn't get translated. After 4.15.0 it will be safe to remove these since everything will use tx(). 3. List of changes for Harmony Theme Let's summarize the changes needed for 4.14.0. Wrap template helper functions that return html with {{}} instead of {}. Replace {translationString} with {{tx(translationString)}}. Wrap API values that should not be translated with {{txEscape(content)}}. (Ongoing) Replace old translation tokens [[namespace:key]] with {{tx("namespace:key")}}. Refer to the Harmony Upgrade Changes Topic for the full list of changes. 4. Bootbox & app.renderAsync & Misc. The global bootbox object has been removed, there is a new modals module that also handles translations. Use modals.(dialog|confirm|alert|prompt) instead of bootbox variants. The only difference is these methods return a promise. So the old const modal = bootbox.dialog() becomes const modal = await modals.dialog() If you are using app.renderAsync to render a template it needs the translation context for tx() helper to work. NodeBB will automatically try to detect the user's language if app.renderAsync is called as part of a web request, but if it is called from a cron job or manually you can pass it the translation data like below: const languages = nodebb.require('./src/languages); const data = { foo: 1, _i18n: languages.getFull('en-GB'), }; const html = await app.renderAsync('mytemplate', data); config.assetBaseUrl was deprecated in 2.x, it is now removed, use config.asset_base_url Why are we doing this? As you know, we have a Bug Bounty Program, and the most commonly reported vulnerability is XSS, which is typically caused by unsanitized user input being rendered directly into HTML. Currently we use the validator module to escape user controlled values however with the introduction of Activitypub support, attackers can manipulate data directly in the database of a remote NodeBB. When this category or user profile is displayed in a target NodeBB instance if any fields are not escaped via validator.escape() then it opens us up for XSS vulnerabilities. By moving the escaping to the template engine, we mitigate this and we no longer have to validator.escape() every value we load from the database. All these changes are now live on this forum. Please let us know if you notice any issues. We plan to release 4.14.0 in July and follow up with 4.15.0 in August. Let us know in the Technical Support category if you need help with updating your themes or plugins.

Hello, I am seeing "error=csrf-invalid" with a NodeBB installation recently upgraded to 4.14.5. The installation is NodeBB 4.14.5 (package version 2.31.5) running in Cloudron 9.2.0 on Ubuntu 24.04.4. Existing sessions continue to work; observed issues are: All attempts to login result in "error=csrf-invalid" and the message "Login Unsuccessful // We were unable to log you in, likely due to an expired session. Please try again" NodeBB users with "admin" privilege cannot actually get to the admin panel (clicking on the "admin" icon takes the user to the /user/admin page rather than the /admin page) Simple things like "(on the server side) let's restart the app and see what happens" and "(on the client side) let's clear all browser cache/cookies/history/data and let's try this on different browsers (Safari/Brave/Chrome)" have been tried to no avail. Any advice for what else I should try?

@testing-ground A test post from Mastodonhello *world*#test

You may have noticed me testing some rich embeds on this forum, or perhaps you've noticed that on this board, pasted links automatically expand/unfurl into a pretty little box instead of staying as a plain anchor. This is due to the Link Preview plugin, which I started working on last month! Link Previews ... wait, why did I just paste a boring ol' anchor like that? https://github.com/NodeBB/nodebb-plugin-link-preview/ SHAZAM! You can install this plugin by running npm install nodebb-plugin-link-preview, or via the plugin manager. It should show up on any NodeBB v3 instance.

Just a quick note for NodeBB admins to update to v4.14.4 as there was a regression identified for versions v4.12.0 to v4.14.3 where federation was broken between NodeBB and Mastodon instances with authorized fetch enabled.