Caddy 2.11.7 → 2.11.8

Vulnerabilities fixed by this upgrade

• 5.9 GHSA-f278-mgc7-46j3 php_fastcgi authorization bypass via dot-segments in the request path
• medium GHSA-jf74-f69g-hcj9 file_server exposes private keys when the data directory falls back to ./caddy
• medium GHSA-69hv-5jfc-mvmv rewrite re-decodes {http.matchers.file.remainder}, bypassing path-based deny rules
• medium GHSA-25cw-38mq-q7m6 file matcher resolves /file/./ to a regular file, bypassing suffix path rules
• high GHSA-r766-rf9f-588h Host and :authority values with dot segments or slashes escape a {host}-based root

Breaking changes

• breaking Requests with an invalid or dots-only host (like ..) are rejected with 400 on every protocol, before any route runs. Before, HTTP/2 and HTTP/3 also accepted hosts containing / or . (#8328) in 2.11.8
• breaking request_body max_size now rejects a request with 413 as soon as its Content-Length is over the limit, even if nothing would have read the body. (#8337) in 2.11.8
• breaking php_fastcgi sites without an index.php: requests for paths that don't exist are now sent to PHP as index.php, as the documented first_exist_fallback try policy always promised, instead of falling through to file_server and returning 404. Also, PATH_INFO and DOCUMENT_URI are now derived from the… in 2.11.8
• breaking A try_files / file candidate ending in / only matches a directory, so /foo.txt/ no longer matches the file /foo.txt. (#8326) in 2.11.8
• breaking encode now compresses responses even when the request has Cache-Control: no-transform (a response's no-transform is still honored), and responses that could have been encoded always get Vary: Accept-Encoding. To keep the old behavior: @transformable not header Cache-Control no-transform and encode… in 2.11.8
• breaking Stricter config validation. Some configs that were silently accepted (and didn't do what you'd expect) are now errors: in 2.11.8
• breaking more than one expression line in the same matcher set (combine them with &&) (#8183) in 2.11.8
• breaking unknown TLS curves or protocol_min / protocol_max names, like TLS1.3 instead of tls1.3, which used to be silently ignored (#8266) in 2.11.8
• breaking a repeated sni_regexp in a TLS policy match block (#8137) in 2.11.8
• breaking ip_mask log filter sizes out of range, like 33 for IPv4 (#8241) in 2.11.8
• breaking basic_auth usernames that end up identical after placeholder expansion (#8315) in 2.11.8
• breaking ports longer than 11 characters (#8277) in 2.11.8
• breaking Evaluation order now follows the Caddyfile for handle_errors blocks with status codes and for vars with non-path matchers. If you had overlapping codes or set the same variable twice, a different block or value may now win. (#8195, #8197) in 2.11.8

Security changes

• security caddyhttp: A Host / :authority value with dot segments or slashes could escape the intended directory when used in file paths, like root /srv/sites/{host}, and with php_fastcgi even execute files outside it. Such hosts are now rejected (see above). Thanks @dunglas. (GHSA-r766-rf9f-588h, #8328) in 2.11.8
• security fastcgi: SCRIPT_FILENAME is now derived from the same normalized path that path matchers see, so a route protected by a path matcher can't be made to run a different script, e.g. with /admin.php/../../other.php. The php_fastcgi rewrite also always runs now (see above). Thanks @pamnario.… in 2.11.8
• security fileserver: The file matcher no longer resolves paths like /.env/./ to the regular file, which bypassed path rules such as path *.env. Thanks @dunglas. (GHSA-25cw-38mq-q7m6, #8326) in 2.11.8
• security rewrite: {http.matchers.file.remainder} is now escaped before rewriting, so double-encoded path info (like ..%252f) can't turn into ../ after path rules have run. Thanks @dunglas. (GHSA-69hv-5jfc-mvmv, #8325) in 2.11.8
• security fileserver: When neither HOME nor XDG_DATA_HOME is set, Caddy's data directory falls back to ./caddy, and a file_server serving the working directory could expose certificates and private keys. That directory is now always hidden. Thanks @dunglas. (GHSA-jf74-f69g-hcj9, #8327) in 2.11.8
• security fastcgi: The php_fastcgi trailing-slash redirect for directories with an index.php can no longer be turned into an open redirect to another site. Thanks @sam-kota. (#8285) in 2.11.8
• security fileserver: Files excluded with hide no longer show up in browse listings, and hidden precompressed sidecars are no longer served. Thanks @agammann. (#8155) in 2.11.8
• security reverseproxy: Hop-by-hop headers are stripped from 1xx responses and from copy_response_headers in handle_response, completing the fix for CVE-2026-55458. Thanks @SssiiiSssii1 and @tomholford. (GHSA-8qx7-j2v2-x6q5, #8256, #8270) in 2.11.8
• security logging: The query log filter now parses request URIs like the server does, so parameters after a # are redacted too. Thanks @jayhemnani9910. (#8255) in 2.11.8

Every release in between