CVE Tools
Track your stack

Caddyserver

6 CVEs tracked since 2026. Since Feb 2026, none of them reached CISA KEV.

Caddyserver CVEs per month

Feb 2026 to Oct 2026. Point at a month, or focus the strip and use the arrow keys.
Caddyserver CVEs per month, with the share now in CISA KEV
MonthCVEsIn CISA KEV
2026-0260
2026-037 or fewer
2026-046 or fewer
2026-057 or fewer
2026-067 or fewer
2026-077 or fewer
2026-088 or fewer
2026-099 or fewer
2026-106 or fewer

Products

The products that kept showing up in Caddyserver's monthly top three, with their CVEs summed over those months.

  1. Caddy61 month

Latest CVEs

The 15 most recently published vulnerabilities affecting Caddyserver.

  1. CVE-2026-92700Caddy: fileHidden() case-sensitive pattern bypass — exposes "hidden" files via case variation—
  2. CVE-2026-92284Caddy: Unbounded body buffer via {http.request.body} placeholder — memory exhaustion DoS—
  3. CVE-2026-77281Caddy: rewrite placeholder re-expansion6.5
  4. CVE-2026-45135Caddy: Unsafe Unicode Handling in FastCGI splitPos Allows Execution of Non-PHP Files8.1
  5. CVE-2026-45692Caddy: Remote Admin Authorization Bypass in `/config` API via Array Index Normalization5.4
  6. CVE-2026-52845Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`8.1
  7. CVE-2026-52844Caddy: Windows `file_server` path authorization bypass via encoded backslash7.5
  8. CVE-2026-52846Caddy: stripHTML template function bypass4.2
  9. CVE-2026-30851Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation8.1
  10. CVE-2026-30852Caddy: vars_regexp double-expands user input, leaking env vars and files7.5
  11. CVE-2026-27590Caddy: Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport9.8
  12. CVE-2026-27589Caddy vulnerable to cross-origin config application via local admin API /load (caddy)6.5
  13. CVE-2026-27588Caddy: MatchHost becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass9.1
  14. CVE-2026-27587Caddy: MatchPath %xx (escaped-path) branch skips case normalization, enabling path-based route/auth bypass9.1
  15. CVE-2026-27586Caddy's mTLS client authentication silently fails open when CA certificate file is missing or malformed9.1

The record

Peak rank
#162 in Feb 2026
Busiest month shown
Feb 2026, 6 CVEs
Months with a KEV entry
0 since Feb 2026
Monthly snapshots
1 since 2026
Caddyserver's full record, month by month