caddy
v2.11.9Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 23 advisories8 high, 14 medium, 1 low · Scorecard 8.3/10
- Supported versions
- 1 line supportednewest 2 · 1 ended
79.1k stars · 5.3k forks · 275 open issues · last release 10 days ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 23 most recent advisories published by the maintainers: 8 high, 14 medium, 1 low. Check the patched version against the one you run.
- mediumGHSA-f278-mgc7-46j3Nov 4, 2026php_fastcgi authorization bypass via dot-segments in the request path
- Affected
- >= 2.4.6, <= 2.11.7
- Patched in
- v2.11.8
- mediumGHSA-jf74-f69g-hcj9Nov 4, 2026file_server exposes private keys when the data directory falls back to ./caddy
- Affected
- <= 2.11.7
- Patched in
- 2.11.8
- mediumGHSA-69hv-5jfc-mvmvNov 4, 2026rewrite re-decodes {http.matchers.file.remainder}, bypassing path-based deny rules
- Affected
- <= 2.11.7
- Patched in
- 2.11.8
- mediumGHSA-25cw-38mq-q7m6Nov 4, 2026file matcher resolves /file/./ to a regular file, bypassing suffix path rules
- Affected
- <= 2.11.7
- Patched in
- 2.11.8
- highGHSA-r766-rf9f-588hNov 4, 2026Host and :authority values with dot segments or slashes escape a {host}-based root
- Affected
- <= 2.11.7
- Patched in
- 2.11.8
- lowCVE-2026-55458Oct 13, 2026RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through
- Affected
- <=v2.11.4
- Patched in
- v2.11.5
- mediumGHSA-6365-7ppr-5r92Jul 10, 2026Connection created for the wrong upstream for forward_auth + reverse_proxy
- Affected
- < v2.11.5
- Patched in
- v.2.11.5
- mediumCVE-2026-77281Jul 10, 2026Three vulnerabilities in Caddy v2.11.3: rewrite placeholder re-expansion, unbounded body buffer DoS, and fileHidden case-sensitivity bypass
- Affected
- <= 2.11.3
- Patched in
- v2.11.4
- highCVE-2026-52845Jun 8, 2026FastCGI header normalization bypass in `forward_auth copy_headers`
- Affected
- < v2.11.4
- Patched in
- v2.11.4
- highCVE-2026-52844Jun 8, 2026Windows `file_server` path authorization bypass via encoded backslash
- Affected
- < v2.11.4
- Patched in
- v2.11.4
- mediumCVE-2026-52846Jun 8, 2026stripHTML template function bypass in github.com/caddyserver/caddy
- Affected
- <= 2.11.3
- Patched in
- v2.11.4
- mediumGHSA-gx7w-56w6-g48xMay 13, 2026Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
- Affected
- < v2.11.3
- Patched in
- v2.11.3
- mediumCVE-2026-45692May 13, 2026Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
- Affected
- v2.4.0 and later
- Patched in
- v2.11.3
- highGHSA-wwhq-w58m-w29cMay 13, 2026Caddy CVE-2026-30852 Fix Bypass
- Affected
- <=2.11.2
- highCVE-2026-45135May 13, 2026Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
- Affected
- >= 2.7.0, <= 2.10.2
- Patched in
- v2.11.3
- mediumCVE-2026-30852Mar 6, 2026vars_regexp double-expands user input, leaking env vars and files
- Affected
- >= v2.7.5, <= v2.11.1
- Patched in
- v2.11.2
- highCVE-2026-30851Mar 6, 2026Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation
- Affected
- >= 2.10.0, < v2.11.2
- Patched in
- v2.11.2
- highCVE-2026-27586Feb 23, 2026mTLS client authentication silently fails open when CA certificate file is missing or malformed
- Affected
- v2.10.2
- Patched in
- v2.11.0
- mediumCVE-2026-27587Feb 23, 2026Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
- Affected
- 2.10.2
- Patched in
- v2.11.0
- mediumCVE-2026-27588Feb 23, 2026Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
- Affected
- 2.10.2
- Patched in
- v2.11.0
- mediumCVE-2026-27589Feb 23, 2026cross-origin config application via local admin API /load (caddy)
- Affected
- (confirmed on main @ e0f8d9b2047af417d8faf354b675941f3dac9891)
- Patched in
- v2.11.0
- highCVE-2026-27590Feb 23, 2026Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport
- Affected
- < v2.11.0
- Patched in
- v2.11.0
- mediumCVE-2026-27585Feb 23, 2026Improper sanitization of glob characters in file matcher may lead to bypassing security protections
- Affected
- < v2.11.0
- Patched in
- v2.11.0