Caddy 2.11.3 → 2.11.7
3 releases · 16 breaking changes · 19 security fixes · 6 advisories fixed
19security16breaking0deprecated28feature5fix
Vulnerabilities fixed by this upgrade
- low CVE-2026-55458 RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
- medium GHSA-6365-7ppr-5r92 Connection created for the wrong upstream for forward_auth + reverse_proxy
- 6.5 CVE-2026-77281 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
- 8.1 CVE-2026-52845 FastCGI header normalization bypass in `forward_auth copy_headers`
- 7.5 CVE-2026-52844 Windows `file_server` path authorization bypass via encoded backslash
- 4.2 CVE-2026-52846 stripHTML template function bypass in github.com/caddyserver/caddy
Breaking changes
- breaking Go 1.26 is now the minimum version for building Caddy and plugins. (#8056) in 2.11.6
- breaking Request headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option. in 2.11.6
- breaking New 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be… in 2.11.6
- breaking Request header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option. in 2.11.6
- breaking A wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920) in 2.11.6
- breaking Stricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors: in 2.11.6
- breaking duplicate named_routes (#7800) in 2.11.6
- breaking duplicate forward_auth uri (#7814) in 2.11.6
- breaking invalid weighted_round_robin weights (#7807) in 2.11.6
- breaking a non-integer browse file_limit (#7988) in 2.11.6
- breaking duplicate or ambiguous map inputs (#8067) in 2.11.6
- breaking malformed map destination placeholders (#8074) in 2.11.6
- breaking module paths with ambiguous @ version separators (#7974) in 2.11.6
- breaking Admin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267) in 2.11.6
- breaking method matcher values are normalized to uppercase, so method get now matches GET requests. (#7832) in 2.11.6
- breaking caddyhttp: remove unused QUICConfig from the HTTP/3 server in 2.11.6
Security changes
- security reverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859) in 2.11.6
- security reverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76. in 2.11.6
- security caddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao. in 2.11.6
- security caddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas. in 2.11.6
- security caddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858) in 2.11.6
- security fileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952) in 2.11.6
- security fileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas. in 2.11.6
- security fastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934) in 2.11.6
- security reverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853) in 2.11.6
- security admin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993) in 2.11.6
- security caddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969) in 2.11.6
- security fastcgi: fix HTTPoxy vulnerability in 2.11.6
- security Fixes CVE-2026-52845: FastCGI header normalization bypass in `forward_auth copy_headers` in 2.11.4
- security Fixes CVE-2026-52844: Windows `file_server` path authorization bypass via encoded backslash in 2.11.4
- security caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102) in 2.11.4
- security rewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt) in 2.11.4
- security templates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz) in 2.11.4
- security caddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch) in 2.11.4
- security Patch for GHSA-vcc4-2c75-vc9v in 2.11.4
Every release in between
featureFixed: crash and dropped streams caused by the new idle timeouts. 2.11.6 introduced default idle read/write timeouts, which caused some problems:
featureIn 2.11.6, the request body's idle deadline could outlive the handler that set it: Both are fixed in #8107. Thanks @steadytao!
featureOver HTTP/2, Caddy could panic with a nil pointer dereference when the reverse proxy was still reading a request body after the handler had returned. (#8101)
featureOver HTTP/1.1, streaming responses to requests with a body, such as SSE clients that open the stream with a POST, were cut off exactly 60 seconds after the body was read. (#8103)
featureOver HTTP/2, streaming responses that paused between writes for longer than write_idle (1 minute by default), like quiet SSE streams, were reset with a stream error. As documented, only a write that stalls should count. Thanks @WeidiDeng! (#8118, #8119)
featureFixed: placeholders for missing cookies are empty again. Since 2.11.6, places that keep unknown placeholders as written, like respond headers, would output {http.request.cookie.} literally when the cookie wasn't in the request. The same happened to {http.request.tls.} on plain HTTP requests. Both…
featureNew: support for the Incremental header field (RFC 10036). It's the standard replacement for NGINX's proprietary X-Accel-Buffering header. If an upstream response has Incremental: ?1, reverse_proxy forwards it immediately, the same as flush_interval -1, and encode streams it instead of holding it…
featureIf the request_buffers or response_buffers options would prevent incremental forwarding, Caddy responds with 501 Not Implemented instead of silently buffering, as the RFC requires.
featureThe new proxy_status_name option adds a Proxy-Status header to those responses, explaining why the message was refused.
featureFaster TLS handshakes: When nothing subscribes to certificate events and debug logging is off, CertMagic no longer builds event data for every handshake. Certificate lookup per handshake is about twice as fast, with 10 allocations instead of 15. Thanks @u5surf! (#8010)
featureUnix sockets: When a reload moves a listener (or the admin endpoint) off a Unix socket, the old socket now closes right away and its file is removed. Before, clients connecting to the old path would hang until the next garbage collection, about 2 minutes later. Thanks @littfed! (#8061)
featureHeaders handler: Multiple Set-Cookie values in a JSON config's set are now sent as separate header fields, instead of being joined with commas into one field that clients can't parse. Thanks @Indra55! (#8080)
featurecaddy fmt no longer deletes an opening brace at the very end of the input. Thanks @n0liu! (#8047)
otherevents: tell CertMagic which events are worth emitting
featurefeat: implement the Incremental header field (RFC 10036)
othercaddyfile: Keep an opening brace that ends the input
otherlisteners: close unix socket immediately and unlink file on reload
otherreverseproxy: stabilise half-close test
othercaddyhttp: keep absent optional placeholders empty
otherheaders: Preserve separate Set-Cookie values
othercaddyhttp: end request-body deadline ownership with handler
fixtimeouts: fix idle writer terminate h2 response writers between writes
featureNew url_pattern request matcher: Match requests with the URLPattern standard, the same syntax used by browsers (JS) and many web frameworks. It supports named groups, wildcards, and regexp components. Captured groups become placeholders ({http.url_pattern..}), and there's a matching url_pattern…
featureSlowloris mitigation: New idle read/write timeouts reset on every successful read or write. A stalled connection gets cut off, and a slow one that's still making progress is left alone. You can also set optional minimum transfer rates, and there's a new timeouts handler directive for per-route…
featureNew tls_automate_names global option: Manage certificates for names without serving them in a site block. (#8015)
featureNew expected_underscore_headers server option: If dropping header fields with underscores in 2.11.4 broke your app, you can now list the specific headers to keep. (#7809)
featureHTTP/3 over Tailscale and other low-MTU links now works, because the initial QUIC packet size is smaller. (#7886)
featurepartial responses are flushed to clients properly (#7849)
featureTCP half-close is propagated on upgraded streams (#8027)
featureversions 3 upstreams now honor tls_trust_pool (#8042)
featureactive health check state is kept separate per check config, so one handler's failing probes don't mark the upstream down for everyone else (#7916)
featurethe random_choose policy distributes correctly now (#7873)
featureServer-sent events behind encode now stream immediately instead of being buffered. (#7905)
featureGraceful shutdown now waits for servers left over from previous configs, so long-lived responses that started before a reload aren't cut off at exit. (#8009)
breakingGo 1.26 is now the minimum version for building Caddy and plugins. (#8056)
breakingRequest headers are limited to 16 KiB by default. Before, we used Go's 1 MB default. Requests with larger headers (giant cookies, oversized tokens, etc.) will now get 431 Request Header Fields Too Large. If you need more, raise it with the max_header_size server option.
breakingNew 1-minute idle read/write timeouts by default. If a request body read or a response write stalls (makes no progress at all) for longer than that, the connection is aborted. Pauses between writes, like with SSE, don't count. Some long-lived streams where the client goes quiet mid-body may be…
breakingRequest header fields containing . are now dropped, the same way underscores were in 2.11.4. PHP folds . to _, so these could be used to impersonate legitimate headers. If you need specific ones, allow them with the new expected_dot_headers server option.
breakingA wildcard site's client_auth no longer applies to more specific hostnames that have their own site blocks. For example, public.example.com no longer inherits mTLS from *.example.com. If you were counting on that inheritance, configure client_auth on the specific site explicitly. (#7920)
breakingStricter config validation. Some configs that used to be silently accepted (and probably didn't do what you expected) are now errors:
breakingduplicate named_routes (#7800)
breakingduplicate forward_auth uri (#7814)
breakinginvalid weighted_round_robin weights (#7807)
breakinga non-integer browse file_limit (#7988)
breakingduplicate or ambiguous map inputs (#8067)
breakingmalformed map destination placeholders (#8074)
breakingmodule paths with ambiguous @ version separators (#7974)
breakingAdmin API /load now returns 400 with warnings inside a valid JSON body when a config is invalid. Before, it returned 200 with two concatenated JSON objects. (#7267)
breakingmethod matcher values are normalized to uppercase, so method get now matches GET requests. (#7832)
securityreverseproxy: When a route used both forward_auth and reverse_proxy, a request could be sent on the wrong upstream connection. Reported by @carlt, fixed by @WeidiDeng. (GHSA-6365-7ppr-5r92, #7859)
securityreverseproxy: Hop-by-hop headers from upstreams are now stripped from 101 Switching Protocols responses too. Thanks @jirn073-76.
securitycaddyhttp: handle_path and uri strip_prefix/strip_suffix now canonicalize the resulting path, so it can't bypass path-based authorization. Thanks @steadytao.
securitycaddyhttp: Extended the 2.11.4 header-alias filter to . (see above) to prevent bypassing forward_auth copy_headers with PHP/FastCGI backends. Thanks @dunglas.
securitycaddyhttp: The path_regexp matcher now normalizes Windows backslashes like the path matcher does. This completes the fix for CVE-2026-52844. Thanks @thientd. (#7858)
securityfileserver: Windows 8.3 short names are rejected in every path component, not just the last one. Thanks @DavidCarliez. (#7952)
securityfileserver: Fixed ETag collisions between files with different modification times and sizes. Thanks @dunglas.
securityfastcgi: The client's Proxy header is no longer passed to backends as HTTP_PROXY (HTTPoxy). Thanks @bzyy1024. (#7934)
securityreverseproxy: Sticky session cookie hashes are compared in constant time. Thanks @alhudz. (#7853)
securityadmin: Request paths are normalized in the remote admin access check, and origin/host allow-lists compare case-insensitively (defense-in-depth). Thanks @AmariahAK, @mohammed90, and @hktitof. (#7910, #7973, #7993)
securitycaddyhttp: Oversized request bodies used through placeholders now correctly return 413. Thanks @hktitof. (#7969)
securityfastcgi: fix HTTPoxy vulnerability
breakingcaddyhttp: remove unused QUICConfig from the HTTP/3 server
+115 more items in the release notessecurityFixes CVE-2026-52845: FastCGI header normalization bypass in `forward_auth copy_headers`
securityFixes CVE-2026-52844: Windows `file_server` path authorization bypass via encoded backslash
securitycaddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102)
securityrewrite: Prevent placeholder re-expansion in injected query (thanks @WhiskerEnt)
securitytemplates: Improved stripHTML action to more reliably remove malformed HTML (thanks to @jmrcsnchz)
securitycaddyhttp: Ignore header fields with underscores to prevent collisions (thanks @Vincent550102 for the report and @dunglas for the patch)
otherreverseproxy: further prevent body closes from dial errors
fixcaddytls: Fix client auth (fix #7724)
otherchore: deps upgrade
othercaddyhttp: omit Last-Modified for unusable mod times
fixcaddytls: fix TLS state races and ECH rotation retry
otherchore: clean up wording and typo fixes
fixreverseproxy: Add regression test for DialInfo network override
featurecaddyauth: add candidate placeholders for rejected identities
othercmd: support caddy start on IPv6-only hosts
othercaddyfile: preserve implicit TLS issuer semantics
otherreverseproxy: wraps request body to prevent closing if not read
othercaddytls: match IDN SNI in connection policies
otherbuild(deps): bump the all-updates group across 1 directory with 9 updates
othercaddyhttp: normalize Windows backslashes in path matcher
othergo.mod: update x/net
otherrewrite: prevent placeholder re-expansion in injected query
featureperf(replacer): optimize memory allocation for file placeholders
othercaddytls: skip idna.ToASCII for pure ASCII SNI values
otherencode: prioritize zstd and br over gzip in content negotiation
fixhttpcaddyfile: fix incorrect error message on duplicate matchers
securityPatch for GHSA-vcc4-2c75-vc9v