CVE-2026-30852
Description
Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request.header.X-Input}, the header value gets resolved once (expected), then passed through repl.ReplaceAll() again (the bug). This means an attacker can put {env.DATABASE_URL} or {file./etc/passwd} in a request header and the server will evaluate it, leaking environment variables, file contents, and system info. This issue has been patched in version 2.11.2.
How to fix
- caddyserver caddy2.11.2 or later
- github.com/caddyserver/caddy/v2/modules/caddyhttp2.11.2 or later
- github.com/caddyserver/caddy/v22.11.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| caddyserver caddy | 2.7.5 ≤ v < 2.11.2 | 2.11.2 |
| github.com/caddyserver/caddy/v2/modules/caddyhttpGo | 2.7.5 ≤ v < 2.11.2 | 2.11.2 |
| github.com/caddyserver/caddy/v2Go | 2.7.5 ≤ v < 2.11.2 | 2.11.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.