Caddy v2.11.8：修复PHP/HTTP/2漏洞，弃用无效Host与超大请求体

This patch release is a big batch of bug fixes and security hardening, plus a handful of small additions. This release is cut from our 2.11 maintenance branch: fixes are backported from master. We recommend upgrading, especially if you serve PHP or use {host} in file paths.

Huge thank you to our sponsors for keeping the project alive with resources, and for our maintainers who triage and assist tirelessly in this relentless new age of AI.

⚠️ Please read the breaking changes below before upgrading. Most of them reject configs or requests that never did what they looked like they did, so most setups won't notice.

Highlights

• Idle timeouts, round two. More fixes for the idle read/write timeouts introduced in 2.11.6:
• Per-route timeouts now take precedence over the server-wide read_body_idle / write_idle, and nested timeouts use the innermost one. (#8121)
• Over HTTP/2, a handler that paused reading the request body (like reverse_proxy uploading to a slow upstream) no longer loses the body and fails with 502. (#8125)
• Deadlines set by handlers now act as a ceiling instead of being overridden, so things like Mercure's dispatch_timeout and FrankenPHP's request_body_timeout work again. Thanks @dunglas! (#8145, #8284)
• HTTP/1.1 uploads that time out with a little body left no longer hang instead of sending the error response. Thanks @SiyXo511! (#8178)
• Binding privileged ports with fewer capabilities (Linux): If CAP_NET_BIND_SERVICE is permitted but not effective, Caddy raises it just for binding a privileged port. Packagers can use setcap cap_net_bind_service=+p instead of +ep, so Caddy still starts under --cap-drop ALL, OpenShift's restricted-v2, or systemd units with an empty CapabilityBoundingSet=. It also follows the kernel's ip_unprivileged_port_start instead of assuming 1024. (#8102, #8253)
• Small additions:
• new log_level directive to set the access log level for matching requests, e.g. log_level @healthchecks DEBUG (#8201)
• new {time.now.rfc3339} placeholder. Thanks @steadytao! (#8140)
• new not matcher for TLS connection policies. Thanks @simonether! (#8138)
• the tls matcher can be used in CEL expression matchers: tls(), tls('complete'), tls('early_data'). Thanks @stackedbyaradhya! (#8088)
• Reverse proxy:
• headers you set yourself (like Strict-Transport-Security via header) are no longer lost when the upstream sends a 1xx response first, like 103 Early Hints (#8169)
• request trailer values are forwarded, not just their names. Thanks @krishsinghhura! (#8246)
• request-only expressions in lb_retry_match no longer retry successful responses (a regression since 2.11.3) (#8168)
• dial errors through a forward proxy and to FastCGI backends are retried like other dial errors. Thanks @adarshxsh and @zemamba! (#8264, #8172)
• weighted_round_robin no longer panics with fewer weights than upstreams, and no longer picks an unavailable upstream when there's only one weight; random_choose picks the least loaded host when all are busy (#8159, #8320, #8160)
• with request_buffers / response_buffers unlimited, a body that fails partway is no longer treated as complete (#8207)
• connections and sockets are no longer leaked when a protocol upgrade (e.g. WebSocket) fails during setup, or when a handle_response status isn't a number. Thanks @Version2beta and @BenMacha! (#8269, #8318)
• HTTP/3 client cancellations are logged at debug level instead of as warnings. Thanks @larrasket! (#8135)
• encode: If-None-Match lists and weak tags get 304s properly (#8128), HEAD responses no longer get a bogus Content-Length (#8150), and Accept-Encoding / Cache-Control split across several header lines are all taken into account, with faster header handling in the proxy too. Thanks @Indra55, @jayhemnani9910 and @dunglas! (#8025)
• PHP / FastCGI: a Location response without a Status is now a 302 redirect, as CGI specifies (#8209), and an app that writes more than its declared Content-Length (like a PHP warning after the page) no longer corrupts HTTP/1.1 responses or kills HTTP/2 connections. Thanks @Sulaiman-Dauda! (#8212)
• TLS & ECH:
• when Caddy rejects Encrypted ClientHello, it now sends retry configs, so clients with stale ECH configs can recover. Thanks @videah! (#8142)
• an ECH public name that also has its own site block keeps that site's TLS settings (#8156)
• client_auth modes request and verify_if_given no longer reject clients without a certificate when verifiers are configured (#8251)
• a site block spanning several listener addresses no longer lets one listener's TLS connection policy (including client authentication) overwrite another's. Thanks @steadytao! (#8192)
• repeated matcher lines in a TLS policy match block are all applied, not just the first. Thanks @simonether! (#8137)
• merged automation policies keep a specific domain's policy ahead of a wildcard's (#8287), and an ACME issuer's network_proxy survives re-provisioning (#8288)
• Caddyfile:
• caddy run prints the error again when startup fails, instead of silently exiting with code 1. Thanks @IndraGunawan! (#8180)
• routes in a group that already matched no longer run their matchers, which fixes e.g. try_files {path} {path}.html?{query} =404 returning 404 for everything (#8189)
• multiple handle_errors blocks and vars now follow Caddyfile order (#8195, #8197)
• each ?Field default in a header block is checked on its own, and respects match (#8217)
• import shows the real OS error for files it can't read (#8163), negative {args[...]} indices no longer panic (#8316), and very long heredoc markers no longer make parsing crawl (#8203, #8249)
• file_server: a path below a regular file (/index.php/foo) is a 404 again and works with pass_thru (#8131); browse handles symlinks in directories with escaped names (#8152) and offsets past the end (#8213)
• templates: template errors no longer keep stale Content-Length / Etag headers (#8149), bodyless responses no longer get Content-Length: 0 (which broke iOS PWAs) (#8153), plus fixes for humanize time layouts with colons and front matter closed with ... (#8215, #8259)
• Logging: include of a parent namespace includes its child modules (#8221), dir_mode from_file no longer creates unusable directories (#8225), and log routing to a site's logger ignores Host case (#8176)
• Admin API: with remote admin access_control, a request is allowed if any permission entry permits it, not just the first (#8317), and Cache-Control: must-revalidate is recognized alongside other directives (#8330)
• Other fixes: caddy hash-password handles Windows line endings and input without a final newline (#8227), a data race in the basic_auth cache is gone (#8278), the Windows service no longer gets stuck in START_PENDING (#8274), and uri strip_prefix / strip_suffix handle percent-escapes and literal % correctly (#8005, #8345)
• Release builds use Go 1.27 (Go 1.26 is still the minimum to build Caddy). (#8210)

⚠️ Breaking changes

• Requests with an invalid or dots-only host (like ..) are rejected with 400 on every protocol, before any route runs. Before, HTTP/2 and HTTP/3 also accepted hosts containing / or \. (#8328)
• request_body max_size now rejects a request with 413 as soon as its Content-Length is over the limit, even if nothing would have read the body. (#8337)
• php_fastcgi sites without an index.php: requests for paths that don't exist are now sent to PHP as index.php, as the documented first_exist_fallback try policy always promised, instead of falling through to file_server and returning 404. Also, PATH_INFO and DOCUMENT_URI are now derived from the normalized path (repeated slashes merged, . segments removed); REQUEST_URI is unchanged.
• A try_files / file candidate ending in / only matches a directory, so /foo.txt/ no longer matches the file /foo.txt. (#8326)