Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Caddy / v2.11.3

Caddy v2.11.3

WAIT

Release notes signal caution: caddyauth: revert user placeholders on auth rejection by @steadytao in #7688

Published: 2026-05-12T15:18:58Z · GitHub release

Summary of changes

This release improves several aspects of Caddy with minor features, bug fixes, and security patches. Thank you to everyone and their bots who contributed to help make this release the best one yet! Security patches: - fastcgi: Carrying over a patch from FrankenPHP for a bug that could allow non-PHP files to be executed; collaborated on by @dunglas, @KC1zs4, and @chenjj. - vars: A more thorough fix for GHSA-m2w3-8f23-hxxf, collaborated by @everping and @vnxme. - admin: Array index normalization to prevent remote admin socket auth bypass, by @Amemoyoi and bot. - admin: More rigorous path prefix matching to prevent remote admin socket auth bypass, by @Amemoyoi and bot. We've also merged a couple PRs that fix upstream security bugs in other projects like quic-go and CertMagic. Thank you to @marten-seemann for maintaining quic-go so diligently! ## What's Changed …

Breaking changes

None detected by heuristics.

CVEs linked to this release

GO-2026-5730 (osv_fixed_in_matches_tag)
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
GO-2026-5408 (osv_fixed_in_matches_tag)
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
GHSA-gx7w-56w6-g48x (osv_fixed_in_matches_tag)
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
CVE-2026-45692 (osv_fixed_in_matches_tag)
Remote Admin Authorization Bypass in "/config" API via Array Index Normalization in github.com/caddyserver/caddy
CVE-2026-45135 (osv_fixed_in_matches_tag)
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files in github.com/caddyserver/caddy

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.