On June 9, 2026, HCL released Nomad for web browsers 1.0.20 (client build 1.0.20.153-135). At first glance the “What’s New” list is short two entries but one of them is the feature plenty of admins have been quietly asking for. So let’s not judge this release by the length of its changelog.
What’s new in HCL Nomad for web browsers
Two headline items ship in 1.0.20: Kiosk Mode and File → Export on Firefox. The rest of the release is stability and security work more on that further down.
Kiosk Mode — the headline feature
Kiosk Mode lets you nominate a single database that always opens on startup and cannot be closed. Think shop-floor terminals, reception check-in screens, warehouse scanners, training rooms anywhere you want people to land in one app and stay there, without the temptation to wander off into the rest of the Notes world.
A word of warning before anyone gets too excited, and HCL says this plainly in the documentation: Kiosk Mode is a user interface feature, not a security feature. It controls what the application looks like and hides the escape hatches, but it is not a lockdown mechanism you should rely on to keep a determined user out of something. Treat it as “shape the experience,” not “secure the endpoint.” For real restrictions, that is still a job for policies and panagenda MarvelClient.
And yes if the old resetNomadInstance=1 trick from 1.0.17 was the “Kiosk Light Mode,” this is the real, full-fat version.
How Kiosk Mode is set up
Enabling Kiosk Mode is a two-part handshake. Both parts have to be in place one without the other does nothing.
First, the database you want to run as the kiosk needs a kioskDB profile document. This profile is what tells Nomad “I am a kiosk app” and carries all the behavior settings (what to hide, whether to open the Workspace, and so on). HCL’s documentation walks through creating it with a small LotusScript agent that writes the profile via GetProfileDocument("kioskDB", "") you run it once against the target database and it stamps the profile in place. There is a matching cleanup agent to remove the profile again if you ever want to take a database out of kiosk duty.
Second, the client has to be pointed at that database using the kioskDBName value in notes.ini. This is the part people forget: the presence of the profile document alone is not enough without the kioskDBName pointer, nothing happens. If the kiosk database lives on a server, use the server!!pathname format (for example CN=myserver/O=mydomain!!AppDirectory/KioskApp.nsf); if you are running against a local replica, just use the local file path (for example /data/KioskApp.nsf). In a managed environment you will almost certainly want to push kioskDBName out centrally rather than touching every client by hand panagenda MarvelClient is the obvious tool for that.
What you can hide and control
The kioskDB profile is where the fun lives. Through it you can decide whether to hide the application menus, hide the help menus, and hide the Sametime icon, whether to open the Workspace on startup, and whether to hide the properties panel. You can also rebrand the chrome: swap the application name for your own logo text, or replace the application icon with your own logo image (the two are mutually exclusive if you set both, the icon wins). Between those switches you can go from “normal Nomad with a locked-open app” all the way to a stripped-back, branded single-purpose terminal. For the full option list and the sample agents, HCL’s Kiosk Mode documentation is the place to look.
File → Export now works on Firefox
The quieter of the two new features, but a welcome bit of consistency: File → Export was already available on the other supported browsers, and now it works on Firefox too. If Firefox is your standard browser, exporting is no longer the odd one out.
Good reasons to upgrade to HCL Nomad Web 1.0.20
Beyond the new features, 1.0.20 ships 11 fixes, and this batch leans noticeably towards security. There are patches for known CVEs in zlib, libpng, yaml, and Lodash, plus a fix for a Nomad server crash on launch with Domino 14.5.1 when OIDC backchannel logout is enabled worth flagging if you are on the newest Domino. There are also some very visible day-to-day fixes, like gray form and table-cell backgrounds no longer rendering as white. The full list, with links to each Knowledge Base article:
| Issue Identifier | Defect Article | Details |
|---|---|---|
| NWASM-9811 | KB0131351 | Security Bulletin: Denial of Service (DoS) vulnerability in zlib affects HCL Nomad for web browsers (CVE-2026-27171) |
| NWASM-9837 | KB0131109 | A navigator in a frameset’s row ratio may drift after browser zoom or layout recalculation |
| NWASM-9873 | KB0129975 | Issues when using an array within a Type container in LotusScript |
| NWASM-9916 | KB0129834 | HCL Nomad server crashes on launch with HCL Domino 14.5.1 when OIDC backchannel logout is enabled |
| NWASM-9936 | KB0131353 | Security Bulletin: Multiple open source vulnerabilities in libpng affect HCL Nomad for web browsers (CVE-2026-33416, CVE-2026-33636) |
| NWASM-9938 | KB0131354 | Security Bulletin: Denial of Service (DoS) vulnerability in yaml affects HCL Nomad server on Domino (CVE-2026-33532) |
| NWASM-9958 | KB0131356 | Security Bulletin: A prototype pollution vulnerability in Lodash affects HCL Nomad for web browsers (CVE-2026-2950) |
| NWASM-9965 | KB0130385 | Crash when COM extension is not installed and session.FileOpBegin is executed |
| NWASM-10055 | KB0130623 | CacheFiles option in nomad-config.yml does not work |
| NWASM-10126 | KB0131099 | Gray form and table cell backgrounds are white |
| NWASM-10143 | KB0131196 | Open Application dialog auto-closed after picking an “Other” server |
You can find the complete, cumulative list in the HCL Nomad for web browsers 1.0.x Release Notes.
One little downside
Every release has its little quirk, and here it is one that hits panagenda MarvelClient users directly so consider this a heads-up. In 1.0.20, HCL added some optimizations for how NOM_-prefixed notes.ini values are handled, and one of those optimizations quietly removed a code path that was still needed. The result: if you point Nomad at your MarvelClient configuration database using NOM_MC_DB (as described in Configuring MarvelClient for Nomad), that database is not picked up. Not ideal if you rely on it to manage your clients.
The good news is the fix and the workaround are both simple. The workaround is to use the MC_DB value instead same thing, just without the NOM_ prefix and your configuration database is honored again. And HCL has already restored the missing code path, so this is resolved in 1.0.21. Details are in KB0131809.
How to get the latest version?
For downloading HCL Nomad Web 1.0.20, you can use the following direct link: NOMAD 1.0.20 All other HCL packages are available on the official download portal: https://my.hcltechsw.com/
Conclusion
HCL Nomad Web 1.0.20 is a short changelog with a long reach. Kiosk Mode is the standout a genuinely useful way to turn Nomad Web into a locked-open, single-app terminal, as long as you remember it is there to shape the experience and not to secure it, and that it takes both the kioskDB profile and the kioskDBName notes.ini pointer to switch on. Add File → Export on Firefox for a bit more cross-browser consistency, and a solid round of security and stability fixes on top, and this becomes an easy release to recommend especially if you run shared or kiosk-style deployments, or you are already on Domino 14.5.1. Just keep the NOM_MC_DB quirk in mind if you manage clients with panagenda MarvelClient: switch to MC_DB for now, or wait for 1.0.21 where it is already fixed.