Disclaimer: Automated heuristics over public release notes and vulnerability databases (OSV / NVD). Can be wrong or incomplete. Always back up first and validate upgrades yourself. Stack Watch does not invent CVE IDs or issue counts. This is an MVP research project, not a live paid service.

Home / Caddy / v2.11.6

Caddy v2.11.6

BREAKING

Breaking-change language found in notes (3 hit(s)). Read migration steps before updating.

Published: 2026-10-01T19:02:27Z · GitHub release

Summary of changes

This patch release contains a large number of minor and some noticeable enhancements and bug fixes. Thank you to everyone who contributed or spent their LLM tokens responsibly to help with this release! We have much more in the pipeline still, as AI has made contributions of all quality levels cheap and easy. We will be trying to go through them as quickly and efficiently as we can. Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI. ⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it. ## Highlights …

Breaking changes

⚠️ Please read the breaking changes below before upgrading. Most of them come from security hardening, and most configs won't notice. If you were relying on one of the old behaviors, though, you'll want to know about it.
⚠️ Breaking changes
⚠️ These security patches may be breaking if your application relies on the buggy behaviors.

CVEs linked to this release

CVE-2026-52844 (mentioned_in_release_notes)
Caddy: Windows file server path authorization bypass via encoded backslash in github.com/caddyserver/caddy

Linked issues / PRs mentioned

109

Back up first

Always back up first. Stack Watch briefs are automated heuristics over public release notes and vulnerability databases. They can be wrong or incomplete. You are responsible for validating upgrades in your own environment. We never invent CVE IDs or issue counts — if a number is missing, it was not found.