Caddy
Web · products/caddy.yaml · RSS
Latest 2.11.7 Oct 3, 2026
Lifecycle
| Branch | Latest | Released | End of life |
|---|---|---|---|
| 2 | 2.11.7 | May 4, 2020 | — · maintained |
| 1 | 1.0.4 | Apr 24, 2019 | Jul 1, 2020 · ended |
Recent releases
breakingGo 1.26 is now the minimum version for building Caddy and plugins. (#8056)
breakingRequest headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
breakingNew 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be…
securityFixes CVE-2026-52845: FastCGI header normalization bypass in `forward_auth copy_headers`
securityFixes CVE-2026-52844: Windows `file_server` path authorization bypass via encoded backslash
securitycaddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
securityFixes GHSA-gx7w-56w6-g48x: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
securityfastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
securityvars: A more thorough fix for https://github.com/advisories/GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
security@NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
security@sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.
securityBuilt on Go 1.26.1 (also released today) which patches several CVEs.
securityfastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
securityadmin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy…
securitycaddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
breaking89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984)
breakingWildcards used by default: Previously, Caddy would obtain individual certificates for every domain in your config literally; now wildcards, if present, will be utilized for subdomains, rather than obtaining individual certificates. This change was motivated by the novel possibility for subdomain…
breaking0d7c63920daecec510202c42816c883fd2dbe047 go.mod: remove glog dependency (#6838)
breaking84364ffcd06e35a93c9bb08ed80617bde72d4f74 caddypki: Remove lifetime check at Caddyfile parse (fix #6878)
securitySecurity
breakingeddbccd298f637c4785c891f5f96dbf103580fa8 fastcgi: remove dir redirection when useless in php_fastcgi (#6698)
breakingcmd: remove zealous check of Caddyfile auto-detection
breakingZeroSSL (#6229) (this is one overall change, but requires some explanation):
breakingUp to now, Caddy used both Let's Encrypt and ZeroSSL by default to get certificates without any configuration. In 2.8, this is changing slightly. Due to upcoming changes to ZeroSSL accounting policies, ZeroSSL now requires your email address to be able to access their free ACME endpoint.
breakingAs such, Caddy will only implicitly add the ZeroSSL issuer to your config if you provide an email address in your Caddyfile using the email global option. (We have already recommended this for years.) If you already do this, you don't have to make any changes and you'll still get Let's Encrypt and…
Security advisories
medium GHSA-6365-7ppr-5r92 Connection created for the wrong upstream for forward_auth + reverse_proxy
6.5 CVE-2026-77281 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
4.3 GHSA-gx7w-56w6-g48x Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
8.1 CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
high CVE-2026-27586 mTLS client authentication silently fails open when CA certificate file is missing or malformed
medium CVE-2026-27587 Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
medium CVE-2026-27588 Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
high CVE-2026-27590 Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
medium CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections