Is Caddy 2.6.4 affected?

Vulnerabilities affecting 2.6.4

• 8.1
  CVE-2026-52845 FastCGI header normalization bypass in `forward_auth copy_headers` fixed in 2.11.4
• 7.5
  CVE-2026-52844 Windows `file_server` path authorization bypass via encoded backslash fixed in 2.11.4
• 6.5
  CVE-2026-77281 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
• 5.9
  GHSA-f278-mgc7-46j3 php_fastcgi authorization bypass via dot-segments in the request path
• 4.3
  GHSA-gx7w-56w6-g48x Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching fixed in 2.11.3
• 4.2
  CVE-2026-52846 stripHTML template function bypass in github.com/caddyserver/caddy
• medium
  GHSA-jf74-f69g-hcj9 file_server exposes private keys when the data directory falls back to ./caddy
• medium
  GHSA-69hv-5jfc-mvmv rewrite re-decodes {http.matchers.file.remainder}, bypassing path-based deny rules
• medium
  GHSA-25cw-38mq-q7m6 file matcher resolves /file/./ to a regular file, bypassing suffix path rules
• high
  GHSA-r766-rf9f-588h Host and :authority values with dot segments or slashes escape a {host}-based root
• low
  CVE-2026-55458 RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
• medium
  GHSA-6365-7ppr-5r92 Connection created for the wrong upstream for forward_auth + reverse_proxy fixed in 2.11.5
• high
  GHSA-wwhq-w58m-w29c Caddy CVE-2026-30852 Fix Bypass
• high
  CVE-2026-27590 Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport fixed in 2.11.0
• medium
  CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections fixed in 2.11.0

Newer releases