Caddy v2.11.8 released on 04-11-2026
Caddy v2.11.8 is out now. It backports security hardening and stricter validation from master, closing several GHSA issues and changing behaviour around hosts, PHP/FastCGI, encoding and proxy handling.
See the release notes on the project’s GitHub for the full changelog and detailed upgrade guidance before you update.
What’s in this release
- Security hardening: hosts with dot segments or slashes are rejected to prevent path escapes when used in file paths, and several file-server and rewrite fixes close path traversal bypasses.
- PHP/FastCGI fixes: SCRIPT_FILENAME is now derived from a normalized path, php_fastcgi reliably runs rewrites and first_exist_fallback sends requests to index.php when appropriate.
- Proxy and header handling: hop-by-hop headers are stripped from interim responses (fixing CVE-2026-55458), reverse_proxy preserves headers after 1xx responses, and request trailers are forwarded correctly.
Upgrade notes
- Breaking changes: invalid or dots-only Host values are now rejected with 400; request_body max_size enforces 413 early using Content-Length; try_files candidates ending in / only match directories. Read the breaking changes section and test configs that rely on {host} or PHP behaviour before upgrading.
- If you need to roll back, keep the previous v2.11.7 binaries available and verify changes in a staging environment before deploying to production.
Share any issues or observations after upgrading — the community and maintainers will appreciate exact repro steps and config snippets if something behaves differently for you.
