Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Caddy / v2.11.4

Caddy v2.11.4

BREAKING

Breaking-change language found in notes (1 hit(s)). Read migration steps before updating.

Published: 2026-06-07T20:53:58Z · GitHub release

Summary of changes

This release patches more security, security-adjacent, and normal bugs. The FrankenPHP project has collaborated on PHP-adjacent patches, which we are grateful for. The recent surge of patches is mostly attributed to token predictors. We have had to reject more than 75% of "security" reports because they were AI slop spam (or just lazy/incorrect). Please use LLMs and agents wisely to avoid wasting precious maintainer resources. We have started blocking offending accounts that spam slop reports. Thank you to all who submit responsible reports following our security policy to make the project better. We appreciate that the community deems the Caddy project worthy of contribution to improve the broader ecosystem! Security-related patches: - caddyhttp: Normalize Windows backslashes in path matcher (thanks @Vincent550102) …

Breaking changes

⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

CVEs linked to this release

CVE-2026-77281 (osv_fixed_in_matches_tag)
Vulnerabilities in handler/placeholder layer in github.com/caddyserver/caddy
CVE-2026-52846 (osv_fixed_in_matches_tag)
Caddy: stripHTML template function bypass in github.com/caddyserver/caddy
CVE-2026-52845 (osv_fixed_in_matches_tag)
Caddy: FastCGI header normalization bypass in forward_auth copy_headers in github.com/caddyserver/caddy
CVE-2026-52844 (osv_fixed_in_matches_tag)
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

Linked issues / PRs mentioned

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.