Is Caddy 2.8.2 affected?

CVSS 8.1

12 known vulnerabilities affect 2.8.2 (highest CVSS 8.1).

12 newer releases in its track, up to 2.11.7. What changed up to 2.11.7

Vulnerabilities affecting 2.8.2

8.1
CVE-2026-52845 FastCGI header normalization bypass in `forward_auth copy_headers` fixed in 2.11.4
7.5
CVE-2026-52844 Windows `file_server` path authorization bypass via encoded backslash fixed in 2.11.4
6.5
CVE-2026-77281 Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
4.3
GHSA-gx7w-56w6-g48x Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching fixed in 2.11.3
4.2
CVE-2026-52846 stripHTML template function bypass in github.com/caddyserver/caddy
low
CVE-2026-55458 RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
medium
GHSA-6365-7ppr-5r92 Connection created for the wrong upstream for forward_auth + reverse_proxy fixed in 2.11.5
high
GHSA-wwhq-w58m-w29c Caddy CVE-2026-30852 Fix Bypass
high
CVE-2026-45135 Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
medium
CVE-2026-30852 vars_regexp double-expands user input, leaking env vars and files
high
CVE-2026-27590 Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport fixed in 2.11.0
medium
CVE-2026-27585 Improper sanitization of glob characters in file matcher may lead to bypassing security protections fixed in 2.11.0