caddyserver vulnerabilities

Newest CVEs

• CVE-2026-92700

  Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation

  caddyserver · caddy

  Medium6.3
• CVE-2026-92284

  Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS

  caddyserver · caddy

  Medium6.9
• CVE-2026-77281

  Caddy: rewrite placeholder re-expansion

  caddyserver · caddy

  Medium6.5
• CVE-2026-45135

  Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files

  caddyserver · caddy

  High8.1
• CVE-2026-45692

  Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization

  caddyserver · caddy

  Medium5.4
• CVE-2026-52845

  Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`

  caddyserver · caddy

  High8.1
• CVE-2026-52844

  Caddy: Windows `file_server` path authorization bypass via encoded backslash

  caddyserver · caddy

  High7.5
• CVE-2026-52846

  Caddy: stripHTML template function bypass

  caddyserver · caddy

  Medium4.2
• CVE-2026-30851

  Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

  caddyserver · caddy

  High8.1
• CVE-2026-30852

  Caddy: vars_regexp double-expands user input, leaking env vars and files

  caddyserver · caddy

  Medium5.5