Caddy v2.11.1：多项安全修复与功能增强

Our community is pleased to announce Caddy 2.11! Of note are new features, numerous bug fixes including several security patches, and various QoL ("quality-of-life") enhancements.

There are no code changes from v2.11.0 other than to a CI job. Due to a recent external change that broke our release process, the first release of 2.11 is v2.11.1.

Special Sponsor Shoutout

Extra big thanks to our major sponsors:

• ZeroSSL
• Stripe
• Railway

They, along with dozens of smaller sponsors, make this project and new releases possible, together with our maintainer team. Thank you all!

Notable changes

• Encrypted ClientHello (ECH) keys are rotated automatically.
• Time-rolling options for logs.
• SIGUSR1 can now reload configuration if it was initially loaded from a file on the command line and did not get changed via the API.
• Reverse proxy now automatically rewrites the Host header to the address of the upstream when the upstream is HTTPS (#7454)
• log_append can now log request and response bodies, useful for debugging.
• Our project now implements and requires Assistance Disclosures (for AI/LLMs) on issues, PRs, comments, replies, reviews, etc.
• Many, many other minor improvements and bug fixes.

Thank you to everyone who was involved this release!

⚠️ Security patches

• fastcgi: CVE-2026-27590 by @dunglas and @AbdrrahimDahmani - Unicode case-folding length expansion causes incorrect split_path index (SCRIPT_NAME/PATH_INFO confusion) in FastCGI transport.
• admin: CVE-2026-27589 by @1seal - Cross-origin requests attempted with no-cors mode could cause some API requests to succeed; such requests are now blocked. (In order for this to be practically exploitable, a web browser executing a malicious web page must be running locally to a production Caddy process.)
• caddyhttp: CVE-2026-27588 by Asim Viladi Oglu Manizada - The Host matcher becomes case-sensitive for large host lists (>100), enabling host-based route/auth bypass.
• caddyhttp: CVE-2026-27587 by Asim Viladi Oglu Manizada - The Path matcher skips case normalization for escape sequences, enabling path-based route/auth bypass.
• caddytls: CVE-2026-27586 by @moscowchill - TLS client authentication silently fails open when CA certificate file is missing or malformed.
• caddyhttp: CVE-2026-27585 by @parrot409 - Improper sanitization of glob characters in file matcher may lead to bypassing security protections.

🚨 Notice for Caddy plugin maintainers: Dependabot will probably alert you to the security fixes in Caddy and urge you to upgrade it in your go.mod file. Please ONLY upgrade the Caddy dependency if there's a change to an exported API your plugin uses. (Then, turn Dependabot off.)

What's Changed

• caddyhttp: add replacer placeholders for escaped values by @Qusic in #7181
• AI assistance disclosure by @mholt in #7212
• caddyfile: Prevent trailing space on line before env variable - Fixes #6881 by @arpansaha13 in #7215
• add: encode header Content-Type graphql-response by @aro-lew in #7214
• caddyhttp: Removing redundant middleware next copy by @maxcelant in #7217
• build(deps): bump the all-updates group with 17 updates by @dependabot[bot] in #7236
• build(deps): bump the actions-deps group with 5 updates by @dependabot[bot] in #7237
• encode: fix response corruption when handle_errors is used by @Siomachkin in #7235
• Fix PKI creation when auto_https is disabled (#7211) by @Siomachkin in #7238
• logging: Buffer the logs before config is loaded by @francislavoie in #7245
• fileserver: set Content-Length for precompressed files by @WeidiDeng in #7251
• refactor: use WaitGroup.Go to simplify code by @mickychang9 in #7253
• caddyfile: Allow block to do nothing if nothing passed to import by @BeeJay28 in #7206
• logging: Adjustments to BufferedLog to keep logs in the correct order by @francislavoie in #7257
• caddyhttp: Prevent commas in header values from being split in CLI commands by @gilbsgilbs in #7268
• update quic-go to v0.54.1 by @marten-seemann in #7273
• chore: ugh, lint fix... by @mohammed90 in #7275
• caddypki: check intermediate lifetime to actual root cert lifetime by @u5surf in #7272
• refactor: omit unnecessary reassignment by @asttool in #7276
• core: use reflect.TypeFor to check for encoding/json.RawMessage by @WeidiDeng in #7274
• core: Reloading with SIGUSR1 if config never changed via admin by @francislavoie in #7258
• build(deps): bump the actions-deps group with 8 updates by @dependabot[bot] in #7284
• httpcaddyfile: Add missing DNS challenge check for acme_dns by @rightaditya in #7270
• httpcaddyfile: Map default_bind to BindHost in globalACMEDefaults by @Monviech in #7278
• Argon2id Support for Basic Auth by @GreyXor in #7186
• update quic-go to v0.55.0 by @marten-seemann in #7288
• reverse_proxy: use http1 for outbound tls requests with placeholder t… by @WeidiDeng in #7296
• caddyhttp: Add server options keepalive_idle and keepalive_count by @joshuamcbeth in #7298
• chore: fix some comments by @wyrapeseed in #7303
• logging: Switch from lumberjack to timberjack, add time-rolling options by @aeris in #7244
• reverseproxy: Use http1.1 upgrade for websocket for extended connect of http2 and http3. by @tonyb486 in #7305
• caddyhttp: Add trusted_proxies_unix for trusting unix socket X-Forwarded-* headers by @cseufert in #7265
• caddyhttp: wrap accepted connection to suppress tls.ConnectionState by @WeidiDeng in #7247
• logging: fix multiple regexp filters on same field (fixes #7049) by @s2010 in #7061
• intercept: use already buffered response if possible when intercepting by @WeidiDeng in #7028
• listeners: Add support for named socket activation by @Siomachkin in #7243
• reverseproxy: do not disable keepalive if proxy protocol is used by @WeidiDeng in #7300
• metrics: resolve per-host inifinite cardinality by @mohammed90 in #7306
• reverseproxy: use http.Protocols to handle h2c requests by @WeidiDeng in #6990
• refactor: use reflect.TypeFor by @wyrapeseed in #7313
• build(deps): bump the all-updates group across 1 directory with 2 updates by @dependabot[bot] in #7307
• build(deps): bump github.com/slackhq/nebula from 1.9.5 to 1.9.7 by @dependabot[bot] in #7315
• feat: switch to autoexport for OpenTelemetry span exporter by @PKeidel in #7317
• reverse_proxy: set default values for keepalive if only some of them are set by @WeidiDeng in #7318
• fix quote within quotes formatted incorrectly by fmt by @keystroke3 in #7045
• caddytls: correct documentation of LeafFolderLoader by @mohammed90 in #7327
• fix golangci-lint error G602 in caddyhttp by @cdenicola in #7334
• feat: allow customizing the Server header by @dunglas in #7338
• update quic-go to v0.56.0, enable qlog for HTTP/3 by @marten-seemann in #7345
• build(deps): bump the all-updates group with 4 updates by @dependabot[bot] in #7333
• feat: custom slog handlers for modules (log contextual data) by @dunglas in #7346
• ci: implement new release flow by @mohammed90 in #7341
• reverse_proxy: use interfaces to modify the behaviors of the transports by @WeidiDeng in #7353
• build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 by @dependabot[bot] in #7355
• update quic-go to v0.57.0 by @marten-seemann in #7359
• refactor: replace HasSuffix+TrimSuffix with CutSuffix by @ledigang in #7357
• Fix retries for requests with bodies by @chebyrash in #7360
• build(deps): bump the all-updates group with 3 updates by @dependabot[bot] in #7376
• ci: escape backticks in changelogs embedded in JS by @mohammed90 in #7382
• build(deps): bump github.com/smallstep/certificates from 0.28.4 to 0.29.0 by @dependabot[bot] in #7381
• caddypki: Add support for multiple intermediates in signing chain by @hslatman in #7057
• caddyhttp: Fix logging on wildcard sites when SkipUnmappedHosts is true by @francislavoie in #7372
• multiplexing: Introduce packet conn wrappers by @vnxme in #7180