caddyserver has 12 CVEs on record between 2022 and 2026. Disclosures have slowed: 3 in the last 90 days after 8 in the 90 before. The busiest recent month was May 2026 with 3. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. Most affected products: github.com/caddyserver/caddy/v2 (8), caddy (3), github.com/caddyserver/caddy (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 8
Products
- github.com/caddyserver/caddy/v2 8
- caddy 3
- github.com/caddyserver/caddy 1
Worst active — by depth score
CVE-2026-92284Medium· 6.9Caddy is an extensible server platform that uses TLS by default50CVE-2026-92700Medium· 6.3Caddy is an extensible server platform that uses TLS by default47CVE-2026-52845High· 8.1Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`45CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash41CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default36
caddyserver vulnerabilities
CVEs affecting caddyserver, newest first. Open any entry for full detail, references, and exploit status.
12 CVEsRSS
CVE-2026-92284Medium· 6.9PoCCaddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body m…
CVE-2026-92700Medium· 6.3PoCCaddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/fileserver/staticfiles.go, fileHidden() uses case-sensitive filepath.Match checks, so case variants can bypass hide rule…
CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite()…
GO-2026-5730NoneCaddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
GO-2026-5408NoneCaddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash
Caddy: Windows `file_server` path authorization bypass via encoded backslash
CVE-2026-52845High· 8.1Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
CVE-2026-52846Medium· 4.2Caddy: stripHTML template function bypass
Caddy: stripHTML template function bypass
GHSA-wwhq-w58m-w29cMediumCaddy CVE-2026-30852 Fix Bypass
Caddy CVE-2026-30852 Fix Bypass
GHSA-gx7w-56w6-g48xMedium· 4.3Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
CVE-2026-45692Medium· 5.4Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
CVE-2022-29718Medium· 6.1Open redirect in caddy
Open redirect in caddy