Trylle

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.

Special Sponsor Shoutout

Extra big thanks to our major sponsors:

They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!

Notable changes

Encrypted ClientHello (ECH) keys are rotated automatically.
Time-rolling options for logs.
SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
log_append can now log request and response bodies, useful for debugging.
Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
Many, many other minor improvements and bug fixes.

Thank you to everyone who was involved this release!

:warning: Security patches

fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.

:rotating_light: Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)

What's Changed

caddyhttp: add replacer placeholders for escaped values by @Qusic in https://github.com/caddyserver/caddy/pull/7181
AI assistance disclosure by @mholt in https://github.com/caddyserver/caddy/pull/7212
caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in https://github.com/caddyserver/caddy/pull/7215
add: encode header Content-Type graphql-response by @aro-lew in https://github.com/caddyserver/caddy/pull/7214
caddyhttp: Removing redundant middleware next copy by @maxcelant in https://github.com/caddyserver/caddy/pull/7217
build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7236
build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7237
encode: fix response corruption when handle_errors is used by @Siomachkin in https://github.com/caddyserver/caddy/pull/7235
Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in https://github.com/caddyserver/caddy/pull/7238
logging: Buffer the logs before config is loaded by @francislavoie in https://github.com/caddyserver/caddy/pull/7245
fileserver: set Content-Length for precompressed files by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7251
refactor: use WaitGroup.Go to simplify code by @mickychang9 in https://github.com/caddyserver/caddy/pull/7253
caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in https://github.com/caddyserver/caddy/pull/7206
logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in https://github.com/caddyserver/caddy/pull/7257
caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in https://github.com/caddyserver/caddy/pull/7268
update quic-go to v0.54.1 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7273
chore: ugh, lint fix... by @mohammed90 in https://github.com/caddyserver/caddy/pull/7275
caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in https://github.com/caddyserver/caddy/pull/7272
refactor: omit unnecessary reassignment by @asttool in https://github.com/caddyserver/caddy/pull/7276
core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7274
core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in https://github.com/caddyserver/caddy/pull/7258
build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7284
httpcaddyfile: Add missing DNS challenge check for acme_dns by @rightaditya in https://github.com/caddyserver/caddy/pull/7270
httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults by @Monviech in https://github.com/caddyserver/caddy/pull/7278
Argon2id Support for Basic Auth by @GreyXor in https://github.com/caddyserver/caddy/pull/7186
update quic-go to v0.55.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7288
reverse_proxy: use http1 for outbound tls requests with placeholder t… by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7296
caddyhttp: Add server options keepalive_idle and keepalive_count by @joshuamcbeth in https://github.com/caddyserver/caddy/pull/7298
chore: fix some comments by @wyrapeseed in https://github.com/caddyserver/caddy/pull/7303
logging: Switch from lumberjack to timberjack, add time-rolling options by @aeris in https://github.com/caddyserver/caddy/pull/7244
reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3. by @tonyb486 in https://github.com/caddyserver/caddy/pull/7305
caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers by @cseufert in https://github.com/caddyserver/caddy/pull/7265
caddyhttp: wrap accepted connection to suppress tls.ConnectionState by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7247
logging: fix multiple regexp filters on same field (fixes #7049) by @s2010 in https://github.com/caddyserver/caddy/pull/7061
intercept: use already buffered response if possible when intercepting by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7028
listeners: Add support for named socket activation by @Siomachkin in https://github.com/caddyserver/caddy/pull/7243
reverseproxy: do not disable keepalive if proxy protocol is used by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7300
metrics: resolve per-host inifinite cardinality by @mohammed90 in https://github.com/caddyserver/caddy/pull/7306
reverseproxy: use http.Protocols to handle h2c requests by @WeidiDeng in https://github.com/caddyserver/caddy/pull/6990
refactor: use reflect.TypeFor by @wyrapeseed in https://github.com/caddyserver/caddy/pull/7313
build(deps): bump the all-updates group across 1 directory with 2 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7307
build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7315
feat: switch to autoexport for OpenTelemetry span exporter by @PKeidel in https://github.com/caddyserver/caddy/pull/7317
reverse_proxy: set default values for keepalive if only some of them are set by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7318
fix quote within quotes formatted incorrectly by fmt by @keystroke3 in https://github.com/caddyserver/caddy/pull/7045
caddytls: correct documentation of LeafFolderLoader by @mohammed90 in https://github.com/caddyserver/caddy/pull/7327
fix golangci-lint error G602 in caddyhttp by @cdenicola in https://github.com/caddyserver/caddy/pull/7334
feat: allow customizing the Server header by @dunglas in https://github.com/caddyserver/caddy/pull/7338
update quic-go to v0.56.0, enable qlog for HTTP/3 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7345
build(deps): bump the all-updates group with 4 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7333
feat: custom slog handlers for modules (log contextual data) by @dunglas in https://github.com/caddyserver/caddy/pull/7346
ci: implement new release flow by @mohammed90 in https://github.com/caddyserver/caddy/pull/7341
reverse_proxy: use interfaces to modify the behaviors of the transports by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7353
build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7355
update quic-go to v0.57.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7359
refactor: replace HasSuffix+TrimSuffix with CutSuffix by @ledigang in https://github.com/caddyserver/caddy/pull/7357
Fix retries for requests with bodies by @chebyrash in https://github.com/caddyserver/caddy/pull/7360
build(deps): bump the all-updates group with 3 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7376
ci: escape backticks in changelogs embedded in JS by @mohammed90 in https://github.com/caddyserver/caddy/pull/7382
build(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.29.0 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7381
caddypki: Add support for multiple intermediates in signing chain by @hslatman in https://github.com/caddyserver/caddy/pull/7057
caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true by @francislavoie in https://github.com/caddyserver/caddy/pull/7372
multiplexing: Introduce packet conn wrappers by @vnxme in https://github.com/caddyserver/caddy/pull/7180
docs: add maybe template function documentation by @steffenbusch in https://github.com/caddyserver/caddy/pull/7388
caddyhttp: create a placeholder for and log ech status by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7328
caddytls: fix preferred chains options by appending values instead of replacing by @okrc in https://github.com/caddyserver/caddy/pull/7387
feat: mark Assert* functions as test helpers by @dunglas in https://github.com/caddyserver/caddy/pull/7380
caddytls: ECH key rotation by @mholt in https://github.com/caddyserver/caddy/pull/7356
caddytls: panic when using tls.ca_pool.source.http -> tls.ca by @Zenexer in https://github.com/caddyserver/caddy/pull/7393
notify: implement windows service status and error notifications by @FreyreCorona in https://github.com/caddyserver/caddy/pull/7389
caddyhttp: {http.request.body_base64} placeholder by @francislavoie in https://github.com/caddyserver/caddy/pull/7367
chore: update tscert package to latest (aea342f6) by @willnorris in https://github.com/caddyserver/caddy/pull/7397
logging: log_append Early option, Supports {http.response.body} by @francislavoie in https://github.com/caddyserver/caddy/pull/7368
update quic-go to v0.58.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7404
cmd: add --json flag to list-modules by @pauloappbr in https://github.com/caddyserver/caddy/pull/7409
Add span attributes to tracing module by @felix-hilden in https://github.com/caddyserver/caddy/pull/7269
readme: fix fence by @mohammed90 in https://github.com/caddyserver/caddy/pull/7416
build(deps): bump the all-updates group across 1 directory with 12 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7421
reverseproxy: make error chan bigger when reverse proxying websocket by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7419
headers: Make ApplyTo nil-safe by @tpaulus in https://github.com/caddyserver/caddy/pull/7426
chore: Dumb prealloc lint fix by @francislavoie in https://github.com/caddyserver/caddy/pull/7430
update quic-go to v0.59.0 by @marten-seemann in https://github.com/caddyserver/caddy/pull/7431
reverseproxy: Avoid returning error if remote address is not an IP by @pauloappbr in https://github.com/caddyserver/caddy/pull/7429
caddyfile: Fix indentation of multiline strings in fmt (#7425) by @pauloappbr in https://github.com/caddyserver/caddy/pull/7433
core: Embed time/tzdata by @francislavoie in https://github.com/caddyserver/caddy/pull/7432
caddyfile: add observe_catchall_hosts option by @mohammed90 in https://github.com/caddyserver/caddy/pull/7434
core: Show JSON error offsets where possible by @francislavoie in https://github.com/caddyserver/caddy/pull/7437
autohttps: deterministic logic and strict bind checking on Linux by @pauloappbr in https://github.com/caddyserver/caddy/pull/7435
reverseproxy: Set Host to {upstream_hostport} automatically if TLS by @francislavoie in https://github.com/caddyserver/caddy/pull/7454
reverseproxy: fix X-Forwarded-* headers for Unix socket requests by @XYenon in https://github.com/caddyserver/caddy/pull/7463
chore: use math/rand/v2 instead of math/rand by @WeidiDeng in https://github.com/caddyserver/caddy/pull/7413
chore: bump Go to v1.26 by @francislavoie in https://github.com/caddyserver/caddy/pull/7466
acmeserver: warn when policy rules unset by @1seal in https://github.com/caddyserver/caddy/pull/7469
caddytls: Return errors instead of nil in client auth provisioning by @moscowchill in https://github.com/caddyserver/caddy/pull/7464
fix(deps): update nebula v1.10.3 to resolve cve by @omercnet in https://github.com/caddyserver/caddy/pull/7471
caddyfile: Add renewal_window_ratio global option by @mehrdadbn9 in https://github.com/caddyserver/caddy/pull/7473
httpcaddyfile: Override global dns with acme_dns (fix #7294) by @rightaditya in https://github.com/caddyserver/caddy/pull/7458
pki: add per-CA configurable maintenance_interval and renewal_window_ratio by @Amirhf1 in https://github.com/caddyserver/caddy/pull/7479
chore: Bump zerossl dependency to 0.1.5 by @francislavoie in https://github.com/caddyserver/caddy/pull/7489
chore: Remove obsolete comment in ech.go by @francislavoie in https://github.com/caddyserver/caddy/pull/7487
caddyhttp: Option to disable 0-RTT by @francislavoie in https://github.com/caddyserver/caddy/pull/7485
dep: upgrade cel-go by @mohammed90 in https://github.com/caddyserver/caddy/pull/7478
build(deps): bump the all-updates group across 1 directory with 12 updates by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7490
refactor: use strings.Builder to improve performance by @zjumathcode in https://github.com/caddyserver/caddy/pull/7364
chore: fix some comments to improve readability by @wangjingcun in https://github.com/caddyserver/caddy/pull/7395
caddytls: Enable debug logging for DNSManager by @francislavoie in https://github.com/caddyserver/caddy/pull/7491
caddytest: make TestReverseProxyHealthCheck deterministic with poll instead of sleep by @Amirhf1 in https://github.com/caddyserver/caddy/pull/7474
admin: Fix tests locally, properly isolate storage by @francislavoie in https://github.com/caddyserver/caddy/pull/7486
chore: Add nolints to work around haywire linters by @mholt in https://github.com/caddyserver/caddy/pull/7493
build(deps): bump filippo.io/edwards25519 from 1.1.0 to 1.1.1 by @dependabot[bot] in https://github.com/caddyserver/caddy/pull/7497
chore: Disable windows/arm build target (Go 1.26 disabled) by @francislavoie in https://github.com/caddyserver/caddy/pull/7503

New Contributors

@Qusic made their first contribution in https://github.com/caddyserver/caddy/pull/7181
@arpansaha13 made their first contribution in https://github.com/caddyserver/caddy/pull/7215
@aro-lew made their first contribution in https://github.com/caddyserver/caddy/pull/7214
@maxcelant made their first contribution in https://github.com/caddyserver/caddy/pull/7217
@Siomachkin made their first contribution in https://github.com/caddyserver/caddy/pull/7235
@mickychang9 made their first contribution in https://github.com/caddyserver/caddy/pull/7253
@asttool made their first contribution in https://github.com/caddyserver/caddy/pull/7276
@rightaditya made their first contribution in https://github.com/caddyserver/caddy/pull/7270
@Monviech made their first contribution in https://github.com/caddyserver/caddy/pull/7278
@wyrapeseed made their first contribution in https://github.com/caddyserver/caddy/pull/7303
@aeris made their first contribution in https://github.com/caddyserver/caddy/pull/7244
@tonyb486 made their first contribution in https://github.com/caddyserver/caddy/pull/7305
@cseufert made their first contribution in https://github.com/caddyserver/caddy/pull/7265
@s2010 made their first contribution in https://github.com/caddyserver/caddy/pull/7061
@PKeidel made their first contribution in https://github.com/caddyserver/caddy/pull/7317
@cdenicola made their first contribution in https://github.com/caddyserver/caddy/pull/7334
@ledigang made their first contribution in https://github.com/caddyserver/caddy/pull/7357
@chebyrash made their first contribution in https://github.com/caddyserver/caddy/pull/7360
@okrc made their first contribution in https://github.com/caddyserver/caddy/pull/7387
@Zenexer made their first contribution in https://github.com/caddyserver/caddy/pull/7393
@FreyreCorona made their first contribution in https://github.com/caddyserver/caddy/pull/7389
@pauloappbr made their first contribution in https://github.com/caddyserver/caddy/pull/7409
@felix-hilden made their first contribution in https://github.com/caddyserver/caddy/pull/7269
@tpaulus made their first contribution in https://github.com/caddyserver/caddy/pull/7426
@1seal made their first contribution in https://github.com/caddyserver/caddy/pull/7469
@moscowchill made their first contribution in https://github.com/caddyserver/caddy/pull/7464
@omercnet made their first contribution in https://github.com/caddyserver/caddy/pull/7471
@mehrdadbn9 made their first contribution in https://github.com/caddyserver/caddy/pull/7473
@Amirhf1 made their first contribution in https://github.com/caddyserver/caddy/pull/7479
@zjumathcode made their first contribution in https://github.com/caddyserver/caddy/pull/7364
@wangjingcun made their first contribution in https://github.com/caddyserver/caddy/pull/7395

Full Changelog: https://github.com/caddyserver/caddy/compare/v2.10.2...v2.11.1