Caddy v2.11.8 released on 04-11-2026
Caddy v2.11.8 is out now. Site operators benefit from a large set of backported security fixes and stricter validation that close several path traversal and exposure vectors.
Visit the Caddy GitHub release page or the official documentation for full details and upgrade instructions.
What’s in this release
- Security hardening: hosts with invalid or dots-only values (for example “..” or hosts containing slashes) are now rejected with 400; {host} in file paths and php_fastcgi handling (SCRIPT_FILENAME and normalized paths) were tightened to prevent remote path traversal and execution outside site roots.
- Reverse proxy, timeouts and connection reliability fixes: per-route timeouts now take precedence over server-wide idle read/write settings, HTTP/2 uploads that pause no longer lose the body or produce 502s, and proxy fixes preserve headers across 1xx responses and forward request trailer values.
- Caddyfile, encode and file_server improvements: new caddyfile directives/placeholders (log_level, {time.now.rfc3339}), encode fixes for ETag/If-None-Match and Vary: Accept-Encoding behaviour, and file_server/templates fixes to avoid accidental exposure of hidden data and sidecars.
Upgrade notes
- Breaking and stricter validation: many previously-ignored configs and requests are now rejected (invalid/dots-only hosts, request_body max_size now enforces 413 via Content-Length, stricter TLS curve/protocol names, repeated matcher lines, invalid ip_mask sizes, overlong ports, etc.). Read the breaking changes carefully and test in staging—pay special attention to php_fastcgi sites and any use of {host} in file paths.
- Rollback option: if these security fixes break an application, you can revert to the previous release (v2.11.7) while you adapt configs; keep backups of your configuration and test changes before applying to production.
Share your experience upgrading or report any issues on the project’s GitHub so others can learn from your testing and troubleshooting.
