Issues

• reverse_proxy: websocket over HTTP/3 or HTTP/2 sends two Sec-WebSocket-Key headers upstream when header ops apply

  caddyserver/caddy#8297 · Filter by author dkulchenko opened on Oct 28, 2026

• http_redirect listener wrapper builds a malformed Location for absolute-form and asterisk-form requests

  bug 🐞
  caddyserver/caddy#8293 · Filter by author jlave-dev opened on Oct 27, 2026
  1

• map: input_regexp mappings do not expand placeholders in outputs

  bug 🐞
  caddyserver/caddy#8292 · Filter by author jlave-dev opened on Oct 27, 2026
  1

• reverseproxy: copy_response_headers forwards a stale Content-Length after handle_response replaces the body

  bug 🐞
  caddyserver/caddy#8291 · Filter by author jlave-dev opened on Oct 27, 2026
  1

• reverseproxy: isBidirectionalStream is unreachable

  caddyserver/caddy#8290 · Filter by author jlave-dev opened on Oct 27, 2026
  1

• httpcaddyfile: merging automation policies can shadow a more specific policy

  caddyserver/caddy#8286 · Filter by author bwisn opened on Oct 27, 2026

• Request: v2.11.8 patch release built with Go ≥ 1.26.10 (Go stdlib + x/net CVEs in official image)

  caddyserver/caddy#8282 · Filter by author stevehockey opened on Oct 27, 2026
  1

• fileserver: try_files stats each existing candidate twice

  caddyserver/caddy#8275 · Filter by author ptondereau opened on Oct 24, 2026
  1

• encode: only the first Accept-Encoding field line is considered

  caddyserver/caddy#8272 · Filter by author kaankucukx opened on Oct 24, 2026

• Current latest binaries use a Go version affected by CVE-2026-111943

  caddyserver/caddy#8268 · Filter by author otbutz opened on Oct 22, 2026
  1

• Method matcher uppercases case-sensitive extension methods

  bug 🐞
  caddyserver/caddy#8244 · Filter by author steadytao opened on Oct 17, 2026

• Config reload closes newly accepted HTTP/1.1 connections with no response (Shutdown before the listener stops accepting)

  caddyserver/caddy#8233 · Filter by author ramonmalcolm10 opened on Oct 16, 2026
  1

• v2.11.6 silently disables client authentication on subdomains that previously inherited it

  bug 🐞
  caddyserver/caddy#8232 · Filter by author reasonableperson opened on Oct 16, 2026 · v2.12.0
  

• caddy reload hangs forever and the admin API dies when the cache maintenance tick lands during TLS.Provision (nil pointer in getAutomationPolicyForName, read lock leaked)

  bug 🐞
  caddyserver/caddy#8231 · Filter by author Roanmh opened on Oct 15, 2026
  3

• fuzz-parse-network-address: Timeout in fuzz-parse-network-address

  bug 🐞
  caddyserver/caddy#8229 · Filter by author mohammed90 opened on Oct 15, 2026
  4

• reverseproxy: health-check redirects still dial the original upstream

  bug 🐞
  caddyserver/caddy#8222 · Filter by author Indra55 opened on Oct 15, 2026
  4

• Session ticket lifetime is too long

  caddyserver/caddy#8218 · Filter by author Synchro opened on Oct 15, 2026
  2

• fileserver: precompressed sidecar's Content-Encoding and Content-Length end up on error responses

  caddyserver/caddy#8204 · Filter by author NitinKumar004 opened on Oct 13, 2026

• Go 1.26 can desynchronise HTTP/1 connections after early upstream responses

  bug 🐞dependencies ⛓️
  caddyserver/caddy#8196 · Filter by author bani6809 opened on Oct 11, 2026 · v2.12.0
  6

• reverseproxy: WebSocket fails with NS_ERROR_NET_RESET in Firefox when network.dns.force_use_https_rr = true

  caddyserver/caddy#8193 · Filter by author androw opened on Oct 11, 2026
  4

• reverseproxy: request hangs when HTTP/2 upstream resets stream while request body read is pending

  caddyserver/caddy#8185 · Filter by author slashfast opened on Oct 9, 2026
  4

• Expose QUIC packet size / PMTUD options (HTTP/3 stalls when path MTU discovery overshoots)

  caddyserver/caddy#8175 · Filter by author MikeRuf opened on Oct 8, 2026
  2

• Panic in deferred write-timeout flush when an upgraded (hijacked) connection outlives write_timeout

  bug 🐞
  caddyserver/caddy#8151 · Filter by author Droid0012 opened on Oct 5, 2026
  1

• core: config reload cleans up handler modules while requests are still running

  caddyserver/caddy#8143 · Filter by author RentnerKev opened on Oct 4, 2026
  2

• Caddy intercepts /.well-known/acme-challenge silently even with a proxy/webroot route override specified.

  documentation 📚
  caddyserver/caddy#8096 · Filter by author Nemezor opened on Oct 1, 2026
  6