v2.11.6
2026-10-01T08:52:10Z•5ed22f766967b71233ab891a80cb733cc0a83440cfd26a000db03aca01198575
CaddyFastCGIauthentication-bypassconfiguration-securityinformation-disclosurepath-traversalprivilege-escalationrelease-notesremote-admin-socketrequest-smugglingreverse-proxysecurity-updateweb-server
What happened
Caddy release feed highlighting security fixes across versions 2.11.2–2.11.4, including forward-auth identity injection and privilege escalation, vars_regexp secret disclosure, remote admin socket authentication bypass, FastCGI execution of non-PHP files, path normalization, query placeholder re-expansion, malformed HTML handling, and header underscore collision protections. The feed also lists newer releases v2.11.5 and v2.11.6 without details. Upgrade to the latest stable release and review the upstream advisories.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- caddyserver_caddy_releases
- Record identifier
- 5ed22f766967b71233ab891a80cb733cc0a83440cfd26a000db03aca01198575
- Enrichment time
- 2026-10-01T08:52:10Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.