Product

caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp vulnerabilities

1 published CVE affecting caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total: 1
Critical: 0
High: 0
Medium: 1
Low: 0
Unscored: 0
CISA KEV: 0

Latest caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp CVEs

Newest publication first

CVE-2026-30852 Caddy: vars_regexp double-expands user input, leaking env vars and files
Published 2026-03-07

MediumCVSS 5.5 EPSS 0.47%

Caddy is an extensible server platform that uses TLS by default. From version 2.7.5 to before version 2.11.2, the vars_regexp matcher in vars.go:337 double-expands user-controlled input through the Caddy replacer. When vars_regexp matches against a placeholder like {http.request....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.

caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp vulnerabilities

Latest caddyserver github.com/caddyserver/caddy/v2/modules/caddyhttp CVEs

CVE-2026-30852 Caddy: vars_regexp double-expands user input, leaking env vars and files