caddyserver has 11 CVEs on record between 2022 and 2026. Disclosures have slowed: 3 in the last 90 days after 7 in the 90 before. The busiest recent month was May 2026 with 4. The median CVSS is 6.3 (medium). None have a confirmed exploitation report. Most affected products: github.com/caddyserver/caddy/v2 (9), caddy (1), github.com/caddyserver/caddy (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.3
- Publish → KEV
- —
- Last 90 days
- 3 prev 7
Products
- github.com/caddyserver/caddy/v2 9
- caddy 1
- github.com/caddyserver/caddy 1
Worst active — by depth score
CVE-2026-52845High· 8.1Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`45CVE-2026-45135High· 8.1Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files45CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash41CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default36CVE-2022-29718Medium· 6.1Open redirect in caddy34
caddyserver vulnerabilities
CVEs affecting caddyserver, newest first. Open any entry for full detail, references, and exploit status.
11 CVEsRSS
CVE-2026-77281Medium· 6.5Caddy is an extensible server platform that uses TLS by default
Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite()…
GO-2026-5730NoneCaddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
Caddy CVE-2026-30852 Fix Bypass in github.com/caddyserver/caddy
GO-2026-5408NoneCaddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in github.com/caddyserver/caddy
CVE-2026-52844High· 7.5Caddy: Windows `file_server` path authorization bypass via encoded backslash
Caddy: Windows `file_server` path authorization bypass via encoded backslash
CVE-2026-52845High· 8.1Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
CVE-2026-52846Medium· 4.2Caddy: stripHTML template function bypass
Caddy: stripHTML template function bypass
GHSA-wwhq-w58m-w29cMediumCaddy CVE-2026-30852 Fix Bypass
Caddy CVE-2026-30852 Fix Bypass
GHSA-gx7w-56w6-g48xMedium· 4.3Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching
CVE-2026-45692Medium· 5.4Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization
CVE-2026-45135High· 8.1Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
CVE-2022-29718Medium· 6.1Open redirect in caddy
Open redirect in caddy