Last 7 days
0
Features: 0
Changes: 0
Fixes: 0
Deprecations: 0
Caddy
Extensible web server with automatic HTTPS and modern protocol support.
Latest Caddy changelog updates, official release notes, breaking changes, security patches, pricing changes, and developer reactions in one product feed.
Follow this Caddy release-notes page to spot useful features, risky migrations, noisy announcements, and source links before they hit your backlog.
Where Caddy updates are checked
Changes.Watch links back to official changelog and release-note sources so summaries stay easy to verify.
Related changelog channels
Use channels to follow groups of tools around a stack, workflow, or topic.
Caddy updates by type
Rolling windows show how many product updates landed in the last 7, 30, 90, and 365 days, grouped by existing changelog semantics.
0
0
1
5
Latest Caddy changelog updates
Added several security fixes including path matcher backslash normalization, header underscore handling, placeholder re‑expansion prevention, and improved HTML stripping (may be breaking for dependent code).
Patched multiple security vulnerabilities, including fastcgi execution, admin socket auth bypasses, and upstream quic go/CertMagic bugs.
Enhanced reverse proxy: fixed health‑check port handling, added passive health checking via dynamic upstream tracking, prevented body‑close on retries, and introduced query‑escaping when PROXY protocol is enabled
Added multiple security fixes addressing CVE‑2026‑27586 through CVE‑2026‑27585, including TLS client auth and host/path matcher hardening.
Ensures logger is initialized before TLS provisioning.
Bumped QUIC Go to v0.54.0 and updated multiple dependencies (golangci, Cloudflare circl), plus code refactors using maps.Copy, slices.Contains, slices.Equal, and CutPrefix for cleaner handling.
Introduces Encrypted ClientHello (ECH) and post‑quantum X25519‑MLKEM768 key exchange for enhanced TLS privacy and security.
Fixed FastCGI handling, disabled HTTP/3 on Unix sockets, corrected log file permission changes, and improved repeated TERM signal handling.
Added new placeholders, matcher capabilities, and TLS handshake/certificate selection matchers, plus CSP nonce support and configurable log file permissions.
Fix regression in automatic Caddyfile detection introduced in v2.8.2.
Fixed bugs affecting ARI handling, root‑path request sanitization, and .caddyfile auto‑detection in the CLI.
Fix merging of consecutive client IP or remote IP matchers
Added ACME Renewal Information support, HTTP/3 for proxy backends, and new configurable ACME policies, TLS modules, and HTTP enhancements.
Templates middleware is now officially extensible, allowing modules to add custom functions/actions.
Fixed HTTP/2 Rapid Reset issue and multiple bugs, improving envfile handling and adding verbose logging for reverse proxy debugging.
Fixed Go 1.21 quic‑go breakage affecting HTTP/3
In‑memory TLS certificate cache now persists across reloads and private keys are not reused, making reloads lightweight and more secure.
Release v2.7.2 is superseded and should not be used
Contains a hotfix for a WebSocket issue.
v2.7.0 is deprecated and should not be used.
Hotfix for regression in v2.6.3 that broke proxying of chunked requests; upgrade recommended.
Added server‑level trusted proxies configuration and pluggable IP range sources; added support for Unix domain sockets on Windows as proxy upstreams.
Fixed numerous bugs across core, listeners, reverse proxy, logging, file server, and HTTP loader (e.g., listener key conflict, upstream scheme handling, logging filters, invalid file path handling).
Core: Reuse existing Unix domain sockets and prevent HTTP/3 over UDS.
Enable RFC 9114 HTTP/3 by default, removing the experimental http3 flag and adding a new protocols setting to toggle HTTP versions
Added /adapt admin endpoint and ETag/If-Match support for the config API, enabling API‑based adapter usage and safe concurrent config updates.
Fixed regressions in Unix socket admin endpoints, Caddy trust command, and duplicate access logs.
Dynamic upstreams and reverse proxy improvements, including X-Forwarded header handling, response copy handler, and deprecation of the srv JSON field.
Fixed numerous bugs across modules, including path matcher sanitization, regex map handling, fastcgi parsing, fileserver behavior, and reverseproxy response handling
Hotfix for regression affecting combined encode and reverse proxy directives introduced in v2.4.4
- Fixed numerous bugs across various modules (acmeserver, admin, caddyfile, caddyhttp, caddytls, cmd, core, encode, fileserver, httpcaddyfile, logging, reverseproxy) and improved error handling.
Removed the reverse‑proxy `max idle conns per host` option (renamed to `keepalive idle conns per host` in Caddyfile, removed in JSON), causing a breaking change for affected configs.
Added Caddyfile support for TLS propagation timeout and new TLS options (preferred chains, skip install trust).
Restored internal redirect handling for admin API `/id/` endpoints and added a parse error for malformed Caddyfile site addresses.
Added secure remote admin API with TLS mutual authentication, server‑identity management, and a self‑upgrade command
Added multi‑issuer TLS support with fallback (defaulting to Let’s Encrypt and ZeroSSL) and alternate certificate chain selection; improved on‑demand TLS handling for large‑scale deployments
Lowered /metrics request log level to Debug and fixed metrics handler to avoid running the next route
Added full ZeroSSL ACME support with automated EAB credentials and replaced the lego library with ACMEz, improving config reload speed, cert management at scale, and structured logging.
Fixed CEL matcher regression and removed pb.proto warning introduced by dependency patches.
Introduced fully automated mTLS certificate handling, including client‑certificate automation for reverse proxy and an embedded ACME server for internal PKI.
Introduces new HTTP handling features (split‑path file matcher, improved duration and access logging, auto‑redirect fixes) and upgrades TLS support to libdns providers.
Fixed FastCGI middleware bug that caused PHP files to be served as plain text on Windows.
Updated to Go 1.12.8, patching HTTP/2 security vulnerabilities.
Fixed multiple bugs and added minor improvements.
Caddy 1.0 released, with future work focused on stability and bug fixes
Upgrade to Go 1.12 and enable TLS 1.3 by default, removing CBC ciphers from the default suite.
Added ability to specify trusted CA certificates in proxy middleware and to disable log rotation
This version is superseded by v0.11.4 due to a regression introduced in the release.
0.11.2 is marked deprecated and should not be used.
Added optional integrated telemetry client for stats and research contributions.
Hotfix release fixing regression from 0.10.13 in ACME certificate handling
Fixes critical TLS security issues: client‑auth bypass, On‑Demand TLS directory traversal, and disables client auth when using QUIC.
Added ACMEv2 production endpoint with automated wildcard certificate support and distributed HTTP‑01 challenge solving
Added service discovery for reverse proxying (DNS SRV) and reusable Caddyfile snippets; introduced 9 new DNS provider plugins for ACME challenges.
Updated pricing structure introduced and Caddy Sponsors header removed.
Added experimental QUIC reverse proxy support via quic:// scheme
Fixed issue 1859 by enabling default slash merging in path comparisons using Go's path.Clean(), aligning behavior with NGINX.
Add three new HTTP plugins: awses, jekyll, and forwardproxy.
Fix runtime error in the fastcgi directive on 32‑bit and ARM architectures
Fixed WebSocket chunked hang, FastCGI persistent‑connection issue, log‑rolling parsing, and added gzip weak‑ETag conversion.
Vendored all dependencies enabling fully reproducible byte‑for‑byte builds
Added support for new plugins: datadog and login.
Hot fix for rewrite directive rule path '/' to correctly match all requests
Reduced memory usage for gzip, templates, and MITM detection.
Added HTTP/2 server push via a new "push" directive, introduced new plugin types and several new directives/flags (index, port flags, challenge disabling).
Enable HTTP timeouts by default via a new 'timeouts' directive, improving security against slowloris attacks.
Added new features: maxrequestbody directive, latency placeholder, serving pre‑compressed .gz/.br files, fastcgi multiple backends with load balancing and customizable timeouts, templates .Files listing and .Include arguments, TLS curve ...
Fixed multiple bugs (fastcgi persistent connections, IP‑hash policy, QUIC update) and added extensive tests
Added `catimeout` option to customize ACME CA HTTP timeout, fixing wildcard on-demand TLS renewal issues.
Fixes numerous bugs from 0.9 and adds a suite of minor enhancements and new placeholders (e.g., {request body}, {latency})
Added TLS session ticket key rotation and customizable certificate key types (including ECC) for improved security.
On Demand TLS added to obtain certificates during handshakes, with configurable max‑certs limit and rate‑limiting safeguards.
Added a new browse middleware default template and a gzip min‑length setting
Added multiple new features such as CLI Caddyfile input, legacy htpasswd support for basicauth, JSON directory listings, log rotation, full error stack traces, and new template methods (.StripExt, .StripHTML)
Listeners now bind to 0.0.0.0 by default; use the "bind" directive to override.
Breaking change: catch‑all redirects no longer preserve the request URI; use the `{uri}` placeholder to keep the path.
Fixed various bugs: timestamps in error logs, gzip default filtering, import handling, query‑string preservation on catch‑all redirects, and correct 403/404 responses for templates.
Removed core `git` directive; now an optional add‑on (breaking change).
Patched timing vulnerability in basicauth middleware
Added HTTPS hardening: customizable cipher suites, removed RC4, and Caddy sites now achieve Qualys SSL Labs A grade when properly configured.
Added git directive, bind directive, root flag, and stdin config input for streamlined deployment and server configuration.
Default host set to 0.0.0.0 with new host and port flags for overriding defaults.
Initial public release of Caddy (v0.5.0).