NginxProxyManager Forbidden - 403 #731

Closed
opened 2026-02-04 21:08:30 +03:00 by OVERLORD · 10 comments
Owner

Originally created by @Ksdmg on GitHub (Apr 1, 2025).

Have you read and understood the above guidelines?

yes

📜 What is the name of the script you are using?

Nginx Proxy Manager

📂 What was the exact command used to execute the script?

bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nginxproxymanager.sh)"

📝 Provide a clear and concise description of the issue.

Hi!
The installation interrupts because a specific package seems to need authentication. However, when manually attempting to download the package, it just works.
I tried with "old version" and current one, but both result in the same error.

⚙️ What settings are you using?

  • Default Settings
  • Advanced Settings

🖥️ Which Linux distribution are you using?

Debian 12

🔄 Steps to reproduce the issue.

Execute the script

Paste the full error output (if available).

  ✔️  Installed pnpm
Would you like to install an older version (v2.10.4)? <y/N> y
  ✔️  Downloaded Nginx Proxy Manager v2.10.4
  ✔️  Set up Environment
 ⠦
   ╭──────────────────────────────────────────────────────────────────╮
   │                                                                  │
   │                Update available! 8.15.9 → 10.7.1.                │
   │   Changelog: https://github.com/pnpm/pnpm/releases/tag/v10.7.1   │
   │                Run "pnpm add -g pnpm" to update.                 │
   │                                                                  │
   │      Follow @pnpmjs for updates: https://twitter.com/pnpmjs      │
   │                                                                  │
   ╰──────────────────────────────────────────────────────────────────╯

 WARN  deprecated node-sass@6.0.1: Node Sass is no longer supported. Please use `sass` or `sass-embedded` instead.
Pr WARN  deprecated messageformat@2.3.0: Package renamed as '@messageformat/core', see messageformat.github.io for more details. 'messageformat@4' will eventually provide a polyfill for Intl.MessageFormat, once it's been defined by Unicode & ECMA.
PrPackages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /root/.local/share/pnpm/store/v3
  Virtual store is at:             node_modules/.pnpm
Pr WARN  deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
Pr WARN  24 deprecated subdependencies found: are-we-there-yet@1.1.7, copy-concurrently@1.0.5, core-js@1.2.7, core-js@2.6.12, figgy-pudding@3.5.2, fs-write-stream-atomic@1.0.10, fsevents@1.2.13, gauge@2.7.4, glob@5.0.15, glob@7.1.7, glob@7.2.3, har-validator@5.1.5, inflight@1.0.6, move-concurrently@1.0.1, npmlog@4.1.2, q@1.5.1, request@2.88.2, resolve-url@0.2.1, rimraf@2.7.1, rimraf@3.0.2, source-map-resolve@0.5.3, source-map-url@0.4.1, urix@0.1.0, uuid@3.4.0
Packages: +903
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Pr ERR_PNPM_FETCH_403  GET https://registry.npmjs.org/camel-case/-/camel-case-3.0.0.tgz: Forbidden - 403
 ⠴
This error happened while installing the dependencies of ejs-webpack-loader@2.2.2
 at html-minifier@3.5.21

No authorization header was set for the request.

No authorization settings were found in the configs.
Try to log in to the registry by running "pnpm login"
or add the auth tokens manually to the ~/.npmrc file.
Progress: resolved 907, reused 0, downloaded 901, added 0
 ⠧
[ERROR] in line 141: exit code 0: while executing command $STD pnpm install

🖼️ Additional context (optional).

No response

Originally created by @Ksdmg on GitHub (Apr 1, 2025). ### ✅ Have you read and understood the above guidelines? yes ### 📜 What is the name of the script you are using? Nginx Proxy Manager ### 📂 What was the exact command used to execute the script? `bash -c "$(curl -fsSL https://raw.githubusercontent.com/community-scripts/ProxmoxVE/main/ct/nginxproxymanager.sh)"` ### 📝 Provide a clear and concise description of the issue. Hi! The installation interrupts because a specific package seems to need authentication. However, when manually attempting to download the package, it just works. I tried with "old version" and current one, but both result in the same error. ### ⚙️ What settings are you using? - [x] Default Settings - [ ] Advanced Settings ### 🖥️ Which Linux distribution are you using? Debian 12 ### 🔄 Steps to reproduce the issue. Execute the script ### ❌ Paste the full error output (if available). ``` ✔️ Installed pnpm Would you like to install an older version (v2.10.4)? <y/N> y ✔️ Downloaded Nginx Proxy Manager v2.10.4 ✔️ Set up Environment ⠦ ╭──────────────────────────────────────────────────────────────────╮ │ │ │ Update available! 8.15.9 → 10.7.1. │ │ Changelog: https://github.com/pnpm/pnpm/releases/tag/v10.7.1 │ │ Run "pnpm add -g pnpm" to update. │ │ │ │ Follow @pnpmjs for updates: https://twitter.com/pnpmjs │ │ │ ╰──────────────────────────────────────────────────────────────────╯  WARN  deprecated node-sass@6.0.1: Node Sass is no longer supported. Please use `sass` or `sass-embedded` instead. Pr WARN  deprecated messageformat@2.3.0: Package renamed as '@messageformat/core', see messageformat.github.io for more details. 'messageformat@4' will eventually provide a polyfill for Intl.MessageFormat, once it's been defined by Unicode & ECMA. PrPackages are hard linked from the content-addressable store to the virtual store. Content-addressable store is at: /root/.local/share/pnpm/store/v3 Virtual store is at: node_modules/.pnpm Pr WARN  deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 Pr WARN  24 deprecated subdependencies found: are-we-there-yet@1.1.7, copy-concurrently@1.0.5, core-js@1.2.7, core-js@2.6.12, figgy-pudding@3.5.2, fs-write-stream-atomic@1.0.10, fsevents@1.2.13, gauge@2.7.4, glob@5.0.15, glob@7.1.7, glob@7.2.3, har-validator@5.1.5, inflight@1.0.6, move-concurrently@1.0.1, npmlog@4.1.2, q@1.5.1, request@2.88.2, resolve-url@0.2.1, rimraf@2.7.1, rimraf@3.0.2, source-map-resolve@0.5.3, source-map-url@0.4.1, urix@0.1.0, uuid@3.4.0 Packages: +903 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Pr ERR_PNPM_FETCH_403  GET https://registry.npmjs.org/camel-case/-/camel-case-3.0.0.tgz: Forbidden - 403 ⠴ This error happened while installing the dependencies of ejs-webpack-loader@2.2.2 at html-minifier@3.5.21 No authorization header was set for the request. No authorization settings were found in the configs. Try to log in to the registry by running "pnpm login" or add the auth tokens manually to the ~/.npmrc file. Progress: resolved 907, reused 0, downloaded 901, added 0 ⠧ [ERROR] in line 141: exit code 0: while executing command $STD pnpm install ``` ### 🖼️ Additional context (optional). _No response_
OVERLORD added the bug label 2026-02-04 21:08:30 +03:00
Author
Owner

@MickLesk commented on GitHub (Apr 1, 2025):

The Option will be removed, because its broken

There is already an PR in Draft

And you get an 403 forbidden

@MickLesk commented on GitHub (Apr 1, 2025): The Option will be removed, because its broken There is already an PR in Draft And you get an 403 forbidden
Author
Owner

@Ksdmg commented on GitHub (Apr 1, 2025):

Thanks for your fast response @MickLesk , but as I have written, it errors out on latest version too. Just happened to copy the information where I have selected the "old version" option.

@Ksdmg commented on GitHub (Apr 1, 2025): Thanks for your fast response @MickLesk , but as I have written, it errors out on latest version too. Just happened to copy the information where I have selected the "old version" option.
Author
Owner

@MickLesk commented on GitHub (Apr 1, 2025):

Then Check your DNS/AdBlock. You get an forbidden. I know, that the Script Work, because i build it 3 times today

@MickLesk commented on GitHub (Apr 1, 2025): Then Check your DNS/AdBlock. You get an forbidden. I know, that the Script Work, because i build it 3 times today
Author
Owner

@Ksdmg commented on GitHub (Apr 1, 2025):

I checked on my internal proxmox, nothing was blocked by pihole. Just to make sure I did also run the script on an external machine that is not behind any kind of firewall or filtering, same error. Here are the logs from the external system:

  ✔️  Installed Openresty
 ⠙=> Downloading nvm from git to '/root/.nvm'
=> Cloning into '/root/.nvm'...
 ⠴remote: Enumerating objects: 382, done.
remote: Counting objects: 100% (382/382), done.
remote: Compressing objects: 100% (325/325), done.
remote: Total 382 (delta 43), reused 178 (delta 29), pack-reused 0 (from 0)
Receiving objects: 100% (382/382), 386.80 KiB | 21.49 MiB/s, done.
Resolving deltas: 100% (43/43), done.
 ⠹* (HEAD detached at FETCH_HEAD)
  master
=> Compressing and cleaning up git repository

=> Appending nvm source string to /root/.bashrc
=> Appending bash_completion source string to /root/.bashrc
=> Close and reopen your terminal to start using nvm or run the following to use it now:

export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"  # This loads nvm
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"  # This loads nvm bash_completion
 ⠦Downloading and installing node v16.20.2...
 ⠧Downloading https://nodejs.org/dist/v16.20.2/node-v16.20.2-linux-x64.tar.xz...
############################################################################################################################################################################################################################## 100.0%
Computing checksum with sha256sum
Checksums matched!
 ⠸Now using node v16.20.2 (npm v8.19.4)
 ⠼Creating default alias: default -> 16.20.2 (-> v16.20.2)
  ✔️  Installed Node.js

added 1 package, and audited 2 packages in 678ms

1 package is looking for funding
  run `npm fund` for details

1 moderate severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.
npm notice 
npm notice New major version of npm available! 8.19.4 -> 11.2.0
npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.2.0
npm notice Run npm install -g npm@11.2.0 to update!
npm notice 
  ✔️  Installed pnpm
Would you like to install an older version (v2.10.4)? <y/N> n
  ✔️  Downloaded Nginx Proxy Manager v2.12.3
  ✔️  Set up Environment
 ⠸ WARN  deprecated messageformat@2.3.0: Package renamed as '@messageformat/core', see messageformat.github.io for more details. 'messageformat@4' will eventually provide a polyfill for Intl.MessageFormat, once it's been defined by Unicode & ECMA.
Pr
   ╭──────────────────────────────────────────────────────────────────╮
   │                                                                  │
   │                Update available! 8.15.9 → 10.7.1.                │
   │   Changelog: https://github.com/pnpm/pnpm/releases/tag/v10.7.1   │
   │                Run "pnpm add -g pnpm" to update.                 │
   │                                                                  │
   │      Follow @pnpmjs for updates: https://twitter.com/pnpmjs      │
   │                                                                  │
   ╰──────────────────────────────────────────────────────────────────╯

 WARN  deprecated node-sass@9.0.0: Node Sass is no longer supported. Please use `sass` or `sass-embedded` instead.
PrPackages are hard linked from the content-addressable store to the virtual store.
  Content-addressable store is at: /root/.local/share/pnpm/store/v3
  Virtual store is at:             node_modules/.pnpm
Pr WARN  deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1
Pr WARN  25 deprecated subdependencies found: @npmcli/move-file@1.1.2, @npmcli/move-file@2.0.1, are-we-there-yet@3.0.1, copy-concurrently@1.0.5, core-js@1.2.7, core-js@2.6.12, figgy-pudding@3.5.2, fs-write-stream-atomic@1.0.10, fsevents@1.2.13, gauge@4.0.4, glob@5.0.15, glob@7.1.7, glob@7.2.3, glob@8.1.0, inflight@1.0.6, move-concurrently@1.0.1, npmlog@6.0.2, q@1.5.1, resolve-url@0.2.1, rimraf@2.7.1, rimraf@3.0.2, source-map-resolve@0.5.3, source-map-url@0.4.1, urix@0.1.0, uuid@3.4.0
Packages: +914
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ERR_PNPM_FETCH_403  GET https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz: Forbidden - 403

This error happened while installing the dependencies of html-webpack-plugin@4.5.2
 at html-minifier-terser@5.1.1

No authorization header was set for the request.

No authorization settings were found in the configs.
Try to log in to the registry by running "pnpm login"
or add the auth tokens manually to the ~/.npmrc file.
Progress: resolved 918, reused 0, downloaded 912, added 0
 ⠹
[ERROR] in line 141: exit code 0: while executing command $STD pnpm install
@Ksdmg commented on GitHub (Apr 1, 2025): I checked on my internal proxmox, nothing was blocked by pihole. Just to make sure I did also run the script on an external machine that is not behind any kind of firewall or filtering, same error. Here are the logs from the external system: ``` ✔️ Installed Openresty ⠙=> Downloading nvm from git to '/root/.nvm' => Cloning into '/root/.nvm'... ⠴remote: Enumerating objects: 382, done. remote: Counting objects: 100% (382/382), done. remote: Compressing objects: 100% (325/325), done. remote: Total 382 (delta 43), reused 178 (delta 29), pack-reused 0 (from 0) Receiving objects: 100% (382/382), 386.80 KiB | 21.49 MiB/s, done. Resolving deltas: 100% (43/43), done. ⠹* (HEAD detached at FETCH_HEAD) master => Compressing and cleaning up git repository => Appending nvm source string to /root/.bashrc => Appending bash_completion source string to /root/.bashrc => Close and reopen your terminal to start using nvm or run the following to use it now: export NVM_DIR="$HOME/.nvm" [ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh" # This loads nvm [ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion" # This loads nvm bash_completion ⠦Downloading and installing node v16.20.2... ⠧Downloading https://nodejs.org/dist/v16.20.2/node-v16.20.2-linux-x64.tar.xz... ############################################################################################################################################################################################################################## 100.0% Computing checksum with sha256sum Checksums matched! ⠸Now using node v16.20.2 (npm v8.19.4) ⠼Creating default alias: default -> 16.20.2 (-> v16.20.2) ✔️ Installed Node.js added 1 package, and audited 2 packages in 678ms 1 package is looking for funding run `npm fund` for details 1 moderate severity vulnerability To address all issues (including breaking changes), run: npm audit fix --force Run `npm audit` for details. npm notice npm notice New major version of npm available! 8.19.4 -> 11.2.0 npm notice Changelog: https://github.com/npm/cli/releases/tag/v11.2.0 npm notice Run npm install -g npm@11.2.0 to update! npm notice ✔️ Installed pnpm Would you like to install an older version (v2.10.4)? <y/N> n ✔️ Downloaded Nginx Proxy Manager v2.12.3 ✔️ Set up Environment ⠸ WARN  deprecated messageformat@2.3.0: Package renamed as '@messageformat/core', see messageformat.github.io for more details. 'messageformat@4' will eventually provide a polyfill for Intl.MessageFormat, once it's been defined by Unicode & ECMA. Pr ╭──────────────────────────────────────────────────────────────────╮ │ │ │ Update available! 8.15.9 → 10.7.1. │ │ Changelog: https://github.com/pnpm/pnpm/releases/tag/v10.7.1 │ │ Run "pnpm add -g pnpm" to update. │ │ │ │ Follow @pnpmjs for updates: https://twitter.com/pnpmjs │ │ │ ╰──────────────────────────────────────────────────────────────────╯  WARN  deprecated node-sass@9.0.0: Node Sass is no longer supported. Please use `sass` or `sass-embedded` instead. PrPackages are hard linked from the content-addressable store to the virtual store. Content-addressable store is at: /root/.local/share/pnpm/store/v3 Virtual store is at: node_modules/.pnpm Pr WARN  deprecated popper.js@1.16.1: You can find the new Popper v2 at @popperjs/core, this package is dedicated to the legacy v1 Pr WARN  25 deprecated subdependencies found: @npmcli/move-file@1.1.2, @npmcli/move-file@2.0.1, are-we-there-yet@3.0.1, copy-concurrently@1.0.5, core-js@1.2.7, core-js@2.6.12, figgy-pudding@3.5.2, fs-write-stream-atomic@1.0.10, fsevents@1.2.13, gauge@4.0.4, glob@5.0.15, glob@7.1.7, glob@7.2.3, glob@8.1.0, inflight@1.0.6, move-concurrently@1.0.1, npmlog@6.0.2, q@1.5.1, resolve-url@0.2.1, rimraf@2.7.1, rimraf@3.0.2, source-map-resolve@0.5.3, source-map-url@0.4.1, urix@0.1.0, uuid@3.4.0 Packages: +914 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++  ERR_PNPM_FETCH_403  GET https://registry.npmjs.org/camel-case/-/camel-case-4.1.2.tgz: Forbidden - 403 This error happened while installing the dependencies of html-webpack-plugin@4.5.2 at html-minifier-terser@5.1.1 No authorization header was set for the request. No authorization settings were found in the configs. Try to log in to the registry by running "pnpm login" or add the auth tokens manually to the ~/.npmrc file. Progress: resolved 918, reused 0, downloaded 912, added 0 ⠹ [ERROR] in line 141: exit code 0: while executing command $STD pnpm install ```
Author
Owner

@MickLesk commented on GitHub (Apr 1, 2025):

@tremor021 other country, can you reproduce this?

@MickLesk commented on GitHub (Apr 1, 2025): @tremor021 other country, can you reproduce this?
Author
Owner

@iloveitaly commented on GitHub (Apr 1, 2025):

I'm getting this same exact error on GitHub actions:

https://github.com/iloveitaly/shadcn-registry-template-github-pages/actions/runs/14201586132/job/39789598423

@iloveitaly commented on GitHub (Apr 1, 2025): I'm getting this same exact error on GitHub actions: https://github.com/iloveitaly/shadcn-registry-template-github-pages/actions/runs/14201586132/job/39789598423
Author
Owner

@MickLesk commented on GitHub (Apr 1, 2025):

Maybe an issue for npm Repo?

@MickLesk commented on GitHub (Apr 1, 2025): Maybe an issue for npm Repo?
Author
Owner

@tremor021 commented on GitHub (Apr 1, 2025):

Image

Works like a charm here!

@tremor021 commented on GitHub (Apr 1, 2025): ![Image](https://github.com/user-attachments/assets/8ddd133d-2b44-4e90-9dc0-741dd26cea11) Works like a charm here!
Author
Owner

@githubaff0 commented on GitHub (Apr 2, 2025):

May relate to https://github.com/npm/cli/issues/8203?

[BUG] Can't install camelcase, decamelize and other camel-related packages (#camelgate) #8203
...
TheDevMinerTV opened [on Apr 1, 2025]
...

✅ NPM fixed:
The issue has been identified and a fix is being implemented. - 17:11 UTC

🛠️ Cloudflare is fixing:
[Identified - Cloudflare has identified an issue with the managed ruleset "Apache Camel - Remote Code Execution - CVE:CVE-2025-29891" which is potentially causing false positives. Customers can disable this rule by setting Action -> Log in the Cloudflare Dashboard. Other WAF rules are unaffected. We are currently working on a fix for this issue.](https://www.cloudflarestatus.com/incidents/gshczn1wxh74)

👀 NPM is investigating:
[We are currently investigating reports of intermittent failures when viewing and installing packages scoped to certain keywords.](https://status.npmjs.org/incidents/hdtkrsqp134s) - 16:40 UTC

👀 First failure in our CI - 15:49:08 UTC
@githubaff0 commented on GitHub (Apr 2, 2025): May relate to https://github.com/npm/cli/issues/8203? > [BUG] Can't install camelcase, decamelize and other camel-related packages (#camelgate) #8203 > ... > [TheDevMinerTV](https://github.com/TheDevMinerTV) opened [on Apr 1, 2025] > ... > > ✅ NPM fixed: > The issue has been identified and a fix is being implemented. - 17:11 UTC > > 🛠️ Cloudflare is fixing: > [Identified - Cloudflare has identified an issue with the managed ruleset "Apache Camel - Remote Code Execution - CVE:CVE-2025-29891" which is potentially causing false positives. Customers can disable this rule by setting Action -> Log in the Cloudflare Dashboard. Other WAF rules are unaffected. We are currently working on a fix for this issue.](https://www.cloudflarestatus.com/incidents/gshczn1wxh74) > > 👀 NPM is investigating: > [We are currently investigating reports of intermittent failures when viewing and installing packages scoped to certain keywords.](https://status.npmjs.org/incidents/hdtkrsqp134s) - 16:40 UTC > > 👀 First failure in our CI - 15:49:08 UTC
Author
Owner

@Ksdmg commented on GitHub (Apr 2, 2025):

I can confirm that it works again on my end. Thanks for your help!

@Ksdmg commented on GitHub (Apr 2, 2025): I can confirm that it works again on my end. Thanks for your help!
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/ProxmoxVE#731