Caddy 2.10.0 → 2.11.7
8 releases · 17 breaking changes · 35 security fixes · 13 advisories fixed
35security17breaking0deprecated89feature43fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-55458 RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
- medium GHSA-6365-7ppr-5r92 Connection created for the wrong upstream for forward_auth + reverse_proxy
- 6.5 CVE-2026-77281 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
- 8.1 CVE-2026-52845 FastCGI header normalization bypass in `forward_auth copy_headers`
- 7.5 CVE-2026-52844 Windows `file_server` path authorization bypass via encoded backslash
- 4.2 CVE-2026-52846 stripHTML template function bypass in github.com/caddyserver/caddy
- 4.3 GHSA-gx7w-56w6-g48x Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
- high GHSA-wwhq-w58m-w29c Caddy CVE-2026-30852 Fix Bypass
- high CVE-2026-45135 Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- medium CVE-2026-30852 vars_regexp double-expands user input, leaking env vars and files
- 8.1 CVE-2026-30851 Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
- high CVE-2026-27590 Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
- medium CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections
Breaking changes
- breaking Go 1.26 is now the minimum version for building Caddy and plugins. (#8056) in 2.11.6
- breaking Request headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option. in 2.11.6
- breaking New 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be… in 2.11.6
- breaking Request header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option. in 2.11.6
- breaking A wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920) in 2.11.6
- breaking Stricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors: in 2.11.6
- breaking duplicate named_routes (#7800) in 2.11.6
- breaking duplicate forward_auth uri (#7814) in 2.11.6
- breaking invalid weighted_round_robin weights (#7807) in 2.11.6
- breaking a non-integer browse file_limit (#7988) in 2.11.6
- breaking duplicate or ambiguous map inputs (#8067) in 2.11.6
- breaking malformed map destination placeholders (#8074) in 2.11.6
- breaking module paths with ambiguous @ version separators (#7974) in 2.11.6
- breaking Admin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267) in 2.11.6
- breaking method matcher values are normalized to uppercase, so method get now matches GET requests. (#7832) in 2.11.6
- breaking caddyhttp: remove unused QUICConfig from the HTTP/3 server in 2.11.6
- breaking 89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984) in 2.10.1
Security changes
- security reverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859) in 2.11.6
- security reverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76. in 2.11.6
- security caddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao. in 2.11.6
- security caddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas. in 2.11.6
- security caddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858) in 2.11.6
- security fileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952) in 2.11.6
- security fileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas. in 2.11.6
- security fastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934) in 2.11.6
- security reverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853) in 2.11.6
- security admin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993) in 2.11.6
- security caddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969) in 2.11.6
- security fastcgi: fix HTTPoxy vulnerability in 2.11.6
- security Fixes CVE-2026-52845: FastCGI header normalization bypass in `forward_auth copy_headers` in 2.11.4
- security Fixes CVE-2026-52844: Windows `file_server` path authorization bypass via encoded backslash in 2.11.4
- security caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102) in 2.11.4
- security rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt) in 2.11.4
- security templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz) in 2.11.4
- security caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch) in 2.11.4
- security Patch for GHSA-vcc4-2c75-vc9v in 2.11.4
- security Fixes GHSA-gx7w-56w6-g48x: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in 2.11.3
- security fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj. in 2.11.3
- security vars: A more thorough fix for https://github.com/advisories/GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme. in 2.11.3
- security admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot. in 2.11.3
- security admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot. in 2.11.3
- security @NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation. in 2.11.2
- security @sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets. in 2.11.2
- security Built on Go 1.26.1 (also released today) which patches several CVEs. in 2.11.2
- security Our documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler. in 2.11.2
- security 2dbcdefbbee68e7b4a31ac66361a0f4e3bcd2eea forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545) in 2.11.2
- security fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport. in 2.11.1
- security admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy… in 2.11.1
- security caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass. in 2.11.1
- security caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass. in 2.11.1
- security caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed. in 2.11.1
- security caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections. in 2.11.1
Every release in between
featureFixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:
featureIn 2.11.6, the request body's idle deadline could outlive the handler that set it: Both are fixed in #8107. Thanks @steadytao!
featureOver HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
featureOver HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)
featureOver HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @WeidiDeng! (#8118, #8119)
featureFixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.} literally when the cookie wasn't in the request. The same happened to {http.request.tls.} on plain HTTP requests. Both…
featureNew: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it…
featureIf the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
featureThe new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.
featureFaster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @u5surf! (#8010)
featureUnix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @littfed! (#8061)
featureHeaders handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @Indra55! (#8080)
featurecaddy fmt no longer deletes an opening brace at the very end of the input. Thanks @n0liu! (#8047)
otherevents: tell CertMagic which events are worth emitting
featurefeat: implement the Incremental header field (RFC 10036)
othercaddyfile: Keep an opening brace that ends the input
otherlisteners: close unix socket immediately and unlink file on reload
otherreverseproxy: stabilise half-close test
othercaddyhttp: keep absent optional placeholders empty
otherheaders: Preserve separate Set-Cookie values
othercaddyhttp: end request-body deadline ownership with handler
fixtimeouts: fix idle writer terminate h2 response writers between writes
featureNew url_pattern request matcher: Match requests with the URLPattern standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders ({http.url_pattern..}), and there's a matching url_pattern…
featureSlowloris mitigation: New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new timeouts handler directive for per-route…
featureNew tls_automate_names global option: Manage certificates for names without serving them in a site block. (#8015)
featureNew expected_underscore_headers server option: If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
featureHTTP/3 over Tailscale and other low-MTU links now works, because the initial QUIC packet size is smaller. (#7886)
featurepartial responses are flushed to clients properly (#7849)
featureTCP half-close is propagated on upgraded streams (#8027)
featureversions 3 upstreams now honor tls_trust_pool (#8042)
featureactive health check state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
featurethe random_choose policy distributes correctly now (#7873)
featureServer-sent events behind encode now stream immediately instead of being buffered. (#7905)
featureGraceful shutdown now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
breakingGo 1.26 is now the minimum version for building Caddy and plugins. (#8056)
breakingRequest headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
breakingNew 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be…
breakingRequest header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option.
breakingA wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920)
breakingStricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors:
breakingduplicate named_routes (#7800)
breakingduplicate forward_auth uri (#7814)
breakinginvalid weighted_round_robin weights (#7807)
breakinga non-integer browse file_limit (#7988)
breakingduplicate or ambiguous map inputs (#8067)
breakingmalformed map destination placeholders (#8074)
breakingmodule paths with ambiguous @ version separators (#7974)
breakingAdmin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267)
breakingmethod matcher values are normalized to uppercase, so method get now matches GET requests. (#7832)
securityreverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859)
securityreverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76.
securitycaddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao.
securitycaddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas.
securitycaddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858)
securityfileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952)
securityfileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas.
securityfastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934)
securityreverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853)
securityadmin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993)
securitycaddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969)
securityfastcgi: fix HTTPoxy vulnerability
breakingcaddyhttp: remove unused QUICConfig from the HTTP/3 server
+115 more items in the release notessecurityFixes CVE-2026-52845: FastCGI header normalization bypass in `forward_auth copy_headers`
securityFixes CVE-2026-52844: Windows `file_server` path authorization bypass via encoded backslash
securitycaddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
securityrewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
securitytemplates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
securitycaddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)
otherreverseproxy: further prevent body closes from dial errors
fixcaddytls: Fix client auth (fix #7724)
otherchore: deps upgrade
othercaddyhttp: omit Last-Modified for unusable mod times
fixcaddytls: fix TLS state races and ECH rotation retry
otherchore: clean up wording and typo fixes
fixreverseproxy: Add regression test for DialInfo network override
featurecaddyauth: add candidate placeholders for rejected identities
othercmd: support caddy start on IPv6-only hosts
othercaddyfile: preserve implicit TLS issuer semantics
otherreverseproxy: wraps request body to prevent closing if not read
othercaddytls: match IDN SNI in connection policies
otherbuild(deps): bump the all-updates group across 1 directory with 9 updates
othercaddyhttp: normalize Windows backslashes in path matcher
othergo.mod: update x/net
otherrewrite: prevent placeholder re-expansion in injected query
featureperf(replacer): optimize memory allocation for file placeholders
othercaddytls: skip idna.ToASCII for pure ASCII SNI values
otherencode: prioritize zstd and br over gzip in content negotiation
fixhttpcaddyfile: fix incorrect error message on duplicate matchers
securityPatch for GHSA-vcc4-2c75-vc9v
securityFixes GHSA-gx7w-56w6-g48x: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
securityfastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj.
securityvars: A more thorough fix for https://github.com/advisories/GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme.
securityadmin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
securityadmin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot.
othercaddyhttp: Sync placeholder expansion in vars and vars_regexp
othercaddytls: Avoid ACME fallback for implicit Tailscale *.ts.net policies
otherchore: Resolve recent CI failures
othercaddytls: Consolidate empty APs more smartly
otherrewrite: skip query rename when source key is absent
featureroot: introduce down-propagating Helper.BlockState for other directives/plugins to use
otherhttp: make zstd checksum configurable
othernotify: Always send "READY=1" even after an error
fixreverseproxy: Fix check for header_up Host {upstream_hostport} redundancy
othercaddytls: Expand placeholders in dns_challenge override_domain tls parameter
featuretls: add system and combined CA pool modules
othervars: Don't expand placeholders in values
otherbuild(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp from 1.42.0 to 1.43.0
otherbuild(deps): bump the all-updates group across 1 directory with 11 updates
otherreverseproxy: make stream copy buffer size configurable
featurevars: Add matcher placeholder handling tests
otherbuild(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4
featurelogging: Add journald encoder wrapper
othercaddyfile: Improve import/global options UX for imports before global options
otherchore: replace interface{} with any for modernization
otherchore: bump timberjack to v1.4.1
otherlogging: Preserve ts for journald-wrapped JSON logs
otherfileserver: show symlink targets verbatim (#7476)
fixfix(caddyfile): {block} in snippet
othercaddyhttp: Document missing placeholders for escaped URI and prefixed query
otherchore: add AGENTS.md
otherbuild(deps): bump github.com/jackc/pgx/v5 from 5.8.0 to 5.9.0
otheradmin: Redact sensitive request headers in API logs
featurereverseproxy: add lb_retry_match condition on response status
featurecaddyhttp: prefer port 443 in auto-HTTPS and add tests
fixfix: Propagate ECH keys to the QUIC listener
featuremetrics: Implement pushing via OLTP
fixlogging: Add regression coverage for rotated file mode
featurereverseproxy: Add ability to clear dynamic upstreams cache during retries
featuretls: Add alpn to managed HTTPS records
+15 more items in the release notesfeatureReverse proxy got a lot of love with certain edge cases related to PROXY protocol, health check port, and closing body on retries. Dynamic upstreams are now tracked which enables passive health checking.
featurePerformance improvements for metrics.
featureNew tls_resolvers global option to control DNS resolvers for all sites when using the ACME DNS challenge.
featureLog rolling now supports zstd compression; deprecated roll_gzip, which will be removed in the future. Use roll_compression instead.
featureRefined logging and some error messages.
featureFixed a bug in rewrite handler that could cause some URIs to not be rewritten when URI path is an escaped form of target path. Thanks to @MaherAzzouzi for the report.
security@NucleiAv reported a bug in the forward_auth directive that could permit identity injection and potential privilege escalation.
security@sammiee5311 reported that vars_regexp double-expanded placeholders, allowing some unusual configs to reveal secrets.
securityBuilt on Go 1.26.1 (also released today) which patches several CVEs.
securityOur documentation has been updated to note that file system case sensitivity may affect the behavior of the hide option of the file_server handler.
feature88616e86e6e656738426bb86b4a42dcc20a59f77 api: Add all in-flight requests /reverse_proxy/upstreams (Fixes #7277) (#7517)
otherd935a6956c16902623b8e8f6d1aafec4f6124f46 autohttps: Ensure CertMagic config is recreated after autohttps runs (#7510)
other5d20adc7a97f70d6fe722099356cca2027908576 build(deps): bump github.com/smallstep/certificates (#7535)
other9371ee67c64d2d2c81f9530be0d9749ecdbd2b00 build(deps): bump the actions-deps group across 1 directory with 12 updates (#7536)
other9798f6964d58eb5703d1498804962faca2dae4ea caddyhttp: Avoid nil pointer dereference in proxyWrapper (#7521)
otherdc360828598440beb1dfdb21c0ba14e09bcd565b caddyhttp: Collect metrics once per route instead of per handler (#7492)
other174fa2ddb93f830370b05058d1ea51ad1512597d caddyhttp: Evaluate tls.client placeholders more accurately (fix #7530) (#7534)
othereac02ee98f9f61d79ae774aa49aa102ddf2076ba caddyhttp: Limit empty Host check to HTTP/1.1
otherf283062d37c50627d53ca682ebae2ce219b35515 cmd: Custom binary names through CustomBinaryName and CustomLongDescription (#7513)
othercd9e1660aa454e6536ad740c9d1aaecf3c3552ed cmd: Pass configFile, not configFlag, for reload command (#7532)
other7b34e3107eb6071fea3a3f94a5c913c32a55afd0 core: Check whether @id is unique (#7002)
other566e710991a6b752933178e2c6126181efc563aa fileserver: document hide case-sensitivity (F-CADDY-FILESERVER-HIDE-CASE-001) (#7548)
feature2dd3852416e2b04bc90b98643673ec9e131c32e6 fix(caddyfile): Prevent parser to panic when no token were added by empty {block} (#7543)
security2dbcdefbbee68e7b4a31ac66361a0f4e3bcd2eea forward_auth: copy_headers does not strip client-supplied identity headers (Fixes GHSA-7r4p-vjf4-gxv4) (#7545)
otherce203aa9e1ff2686777019f45c36c283debb7986 go.mod: Upgrade x/net
other76b198f586e4e2482a0278ba52c176cff70af8cf http: Sort auto-HTTPS redirect routes by host specificity (fixes #7390) (#7502)
fix7ffb640a4da666203ab43396eaeb2b6b84bb983f httpcaddyfile: Fix missing TLS connection policies when auto_https is default (#7325) (#7507)
other45cf61b1276b2cf79ce0147df8fa48c96e8e5356 logging: Ensure slog error level logs don't print stack traces (#7512)
other987375297862d9cd0a3fa33cfb199c25e504ad1b logging: Support zstd roll compression (#7515)
feature294dfff4435c31b7c8d20d26067365b0a0016610 logging: add DirMode options and propagate FileMode to rotations (#7335)
othera6acb3902cb6453153db0738bd8210e093449ce1 proxyproto: Generated test coverage (#7540)
fix11b56c6cfc25f8c814fa66cb02060548d12c4040 reverseproxy: Fix health_port being ignored in health checks (#7533)
otherdb2986028fc573ae3add0a9a3381268dd7599267 reverseproxy: Track dynamic upstreams, enable passive healthchecking (#7539)
fixd7b21c610494e30e147de77a4783c18e5f206d99 reverseproxy: fix tls dialing w/ proxy protocol (#7508)
othera5e7c6e232573b8a8df2946914a84a36070d4b9f reverseproxy: prevent body close on dial-error retries (#7547)
other2ab043b8903db4574b2fc7a625619018a072f082 reverseproxy: query escape request urls when proxy protocol is enabled (#7537)
otherfbfb8fc517728f85890cd46559c01bec9495bf17 rewrite: Force recomputing path when escaped path matches rewrite target
featuref145bce553a306ca6890fea782ca4e3b06787bbb tls: Add tls_resolvers global option for DNS challenge configuration (#7297)
featureOur project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
fixMany, many other minor improvements and bug fixes.
securityfastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
securityadmin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy…
securitycaddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
securitycaddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
securitycaddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
securitycaddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.
featurecaddyhttp: add replacer placeholders for escaped values
fixcaddyfile: Prevent trailing space on line before env variable - Fixes #6881
featureadd: encode header Content-Type graphql-response
fixencode: fix response corruption when handle_errors is used
fixFix PKI creation when auto_https is disabled (#7211)
featurecaddyfile: Allow block to do nothing if nothing passed to import
featurehttpcaddyfile: Add missing DNS challenge check for acme_dns
featureArgon2id Support for Basic Auth
featurecaddyhttp: Add server options keepalive_idle and keepalive_count
featurelogging: Switch from lumberjack to timberjack, add time-rolling options
featurecaddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers
fixlogging: fix multiple regexp filters on same field (fixes #7049)
featurelisteners: Add support for named socket activation
featurefeat: switch to autoexport for OpenTelemetry span exporter
fixfix quote within quotes formatted incorrectly by fmt
fixfix golangci-lint error G602 in caddyhttp
featurefeat: allow customizing the Server header
featurefeat: custom slog handlers for modules (log contextual data)
fixFix retries for requests with bodies
featurecaddypki: Add support for multiple intermediates in signing chain
fixcaddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true
featuremultiplexing: Introduce packet conn wrappers
fixcaddytls: fix preferred chains options by appending values instead of replacing
featurefeat: mark Assert* functions as test helpers
featurenotify: implement windows service status and error notifications
featurecmd: add --json flag to list-modules
featureAdd span attributes to tracing module
fixreadme: fix fence
fixcaddyfile: Fix indentation of multiline strings in fmt (#7425)
featurecaddyfile: add observe_catchall_hosts option
featurecaddyfile: Add renewal_window_ratio global option
featurepki: add per-CA configurable maintenance_interval and renewal_window_ratio
+83 more items in the release notesotherhttp: Make logger first, before TLS provisioning
fixhttpcaddyfile: Fix acme_dns regression
fixcaddyfile: Fix importing nested tokens for {block}
fix551f793700fe1550845c824470b623fd1aa03d36 caddyfile: Fix importing nested tokens for {block} (#7189)
other16fe83c7afe2152b0bb53ae35078a28f87e6dcf2 http: Make logger first, before TLS provisioning (#7198)
fix4564261d8350f8010b7e001e646e260e9bba5746 httpcaddyfile: Fix acme_dns regression (#7199)
otherupdate quic-go to v0.51.0
otherforwardproxy: reference correct field name in LoadModule
fixfix: Remove nil arg from zapslog.NewHandler call
featurefileserver: Add support for .avif image format
otherreverseproxy: use DialTLSContext for TLS if servername has placeholder
otheradmin: Make sure that any admin routers are provisioned when local/re…
otherlog: default logger should respect {in,ex}clude
fixacme_server: fix policy parsing in caddyfile
featureimplement Unwrap for interceptedResponseHandler
fixcaddyhttp: fix route sort by comparing paths without wildcard if they don't shar…
fixfix: crash - null check on event origin
fixfix: prevent error handler from overriding sub handler matchers
fixcmd: fix Commands function not returning all registered commands
featurecore: clean up new config if it failed to run
feature[ADD] sort buttons in grid mode
fixFix: Support placeholders in header replacement search patterns
fixfix dead link
fixfix(provisioning): Context.App or Context.AppIfConfigured will return (val, nil) even if the app failed to provision or validate the first time
featurecmd: Allow caddy adapt to read from stdin
featurefeat: add bcrypt cost parameter to hash-password
fixfix typo in bcrypt cost flag name
fixcaddytls: fix regression in external certificate manager support
featurereverse_proxy: use the new KeepAliveConfig to set probe interval
featuredoc: Add a few lines about Etag file content
featurecaddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests
fix44d078b6705c7abcabb2a60f501568ff7f5a57a1 acme_server: fix policy parsing in caddyfile (#7006)
feature49dac61b078a704b3e98566134c108d6def19450 bcrypt: add cost parameter to hash-password (#7149)
feature14a63a26b9a673857fc37cba37aedc35a10ce634 caddyhttp: use the new http.Protocols to handle h1, h2 and h2c requests (#6961)
fixb898873b90b5cb804400888ec2f2994f6a2dd270 caddytls: fix regression in external certificate manager support (#7179)
feature19ff47a63b9ff2ae424790b02548d9ba4afc56ba cmd: Allow caddy adapt to read from stdin (#7163)
fixe633d013f64d057f462786ccf4a430cd27817d4d cmd: fix Commands function not returning all registered commands (#7059)
feature3d0b4fac5a583d615fe411a4af9a24a7bcc3bee3 core: Clean up new config if it failed to run (#7068)
featureb9710c6af4f764b463a8e0c080783f2b7fb15ce0 fileserver: Add a few doc lines about Etag file content (#7173)
feature3b4d966fba069e9895980dbbf05f84bf818968ba fileserver: Add sort buttons in grid mode (#7089)
feature54d03ced48a8ed2264ae9248c81f00a1c2648d82 fileserver: Add support for .avif image format (#6988)
breaking89ed5f44de61fcb0c3b7ce93bfefbb8e775d1964 fix: Remove nil arg from zapslog.NewHandler call (#6984)
feature5b727bde2992e7cb9987208453db42ae6e1c6e1e httpcaddyfile: Allow naked acme_dns if dns is set (fix #7091)
fix0badb071efc38bb9cc055076f0a48d1725fe8cc8 httpcaddyfile: Fix generated config related to ACME global options
feature716d72e47538cc4f7bab43b1d973e0f8aa0a9fba intercept: implement Unwrap for interceptedResponseHandler (#7016)
feature1c596e3c5a1cd0b52febb1506ffe471918bd1128 reverse_proxy: use the new KeepAliveConfig to set probe interval (#7157)
+72 more items in the release notes