caddy
- Software type
- Web server
- Total vulnerabilities (90 days)
- Products & ServicesProducts & Services
- SolutionsSolutions
- PricingPricing
- CompanyCompany
- ResourcesResources
en
en
As of 10/23/2026, caddy recorded 3 security vulnerabilities in the last 90 days, of which 0 are rated High or Critical. None of these vulnerabilities is actively exploited (KEV) according to CISA's catalog. CyStack recommends that organizations and individual users apply patches as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of caddy and determine which vulnerabilities affect that version.
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variationCVE-2026-92284Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoSCVE-2026-77281Caddy: rewrite placeholder re-expansionCVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP FilesCVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation | Exploitation statusActively exploited | FixNo |
| SeverityMedium |
CVE-2026-92284Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS | Exploitation statusActively exploited | FixNo | Published09/23/2026 | SeverityMedium |
|---|
CVE-2026-77281Caddy: rewrite placeholder re-expansion | Exploitation statusNot exploited | FixYes | Published09/17/2026 | SeverityMedium |
|---|
CVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityHigh |
|---|
CVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityMedium |
|---|
CVE-2026-52845Caddy: FastCGI header normalization bypass in `forward_auth copy_headers` | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityHigh |
|---|
CVE-2026-52844Caddy: Windows `file_server` path authorization bypass via encoded backslash | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityHigh |
|---|
CVE-2026-52846Caddy: stripHTML template function bypass | Exploitation statusActively exploited | FixYes | Published06/23/2026 | SeverityMedium |
|---|
CVE-2026-30851Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityHigh |
|---|
CVE-2026-30852Caddy: vars_regexp double-expands user input, leaking env vars and files | Exploitation statusActively exploited | FixYes | Published03/07/2026 | SeverityMedium |
|---|
23 Results | Page 1 of 3