Infrastructure
Caddy: supported versions and open vulnerabilities today
Caddy 2 is supported; 1 reached end of life on Jul 1, 2020; the latest release is 2.11.7. 7 high or critical advisories for Caddy were published in the last 12 months; none of its advisories is on CISA’s list of exploited vulnerabilities.
Last checked against endoflife.date, OSV.dev, CISA KEV, FIRST EPSS and deps.dev.
- Latest release
- 2.11.7
- GitHub stars
- 77.8k
- Licence
- Apache-2.0
- OpenSSF Scorecard
- 9.3 / 10
Supported versions
Security advisories
16 advisories published in the last 12 months, 7 of them high or critical, 2 without a severity rating. 18 in total since records began. Checked packages: github.com/caddyserver/caddy/v2.
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Fixed in 2.11.4.
EPSS: top 63%Caddy: Windows `file_server` path authorization bypass via encoded backslash
Fixed in 2.11.4.
EPSS: top 52%Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files
Fixed in 2.11.3.
EPSS: top 49%Caddy: Unicode case-folding length expansion causes incorrect split_path index in FastCGI transport
Fixed in 2.11.1.
EPSS: top 42%Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass
Fixed in 2.11.1.
EPSS: top 56%Caddy: mTLS client authentication silently fails open when CA certificate file is missing or malformed
Fixed in 2.11.1.
EPSS: top 68%Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass
Fixed in 2.11.1.
EPSS: top 56%
Maintenance and supply chain
OpenSSF Scorecard 9.3 / 10 (scored )
The Scorecard rates the repository’s security practices, not known vulnerabilities. Recent activity: 30 commits and 14 issue updates found in the last 90 days.
Weakest checks
- No OpenSSF best-practices badge (CII-Best-Practices 2/10)
Alternatives
Nginx
High-performance web server and reverse proxy
Strengths
- Extremely fast and lightweight
- Low resource usage
Trade-offs
- Configuration syntax can be complex
- Advanced features require Nginx Plus
HAProxy
Reliable, high-performance TCP/HTTP load balancer
Strengths
- Very high performance
- Advanced health checking
Trade-offs
- Configuration can be complex
- Less suitable for serving static content
Traefik
Modern HTTP reverse proxy and load balancer for microservices
Strengths
- Automatic service discovery
- Native Docker/Kubernetes integration
Trade-offs
- Higher resource usage than Nginx/HAProxy
- Younger project with smaller community
AWS ALB
AWS Application Load Balancer for HTTP/HTTPS traffic
Strengths
- Fully managed by AWS
- Native AWS service integration
Trade-offs
- AWS vendor lock-in
- Limited customization
Docs and release notes
Check Caddy in your own stack
This page checks Caddy in general. Your repo pins specific versions: the free dependency check reads your manifests and lists what to fix first. Prism Agent runs the same live checks on your whole stack and turns them into a plan your coding agent can build.