Is github.com/caddyserver/caddy/v2 safe ? github.com/caddyserver/caddy/v2 (go) has 19 known vulnerabilities, the worst rated HIGH. No single fixed version is recorded that clears every advisory, so check each one below. No malicious-package signal is recorded.
// reach 192 direct dependencies
39 carry known advisories, worst CRITICAL
4 packages depend on it
an advisory here reaches each of them
// ai model usage Tracked for PyPI packages. HuggingFace models declare Python dependencies, so go packages are not covered.
cvss CVSS v3.1 base score out of 10
epss chance of exploitation in 30 days, 39th percentile of all CVEs
xyz score CyberXYZ composite out of 10
fig. 01 — GHSA-f59h-q822-g45g, the advisory selected below
// 19 advisories GHSA-f59h-q822-g45g forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. HIGH GHSA-qrp7-cvwr-j2c6 On Windows, Caddy path matchers treat /private\secret.txt as outside /private/, but fileserver later resolves the same request path as private\secret.txt on… HIGH GHSA-m675-2p33-xv9g The FastCGI transport's splitPos() in modules/caddyhttp/reverseproxy/fastcgi/fastcgi.go misuses golang.org/x/text/search with search.IgnoreCase when the… HIGH GHSA-x76f-jf84-rqj8 Caddy's HTTP host request matcher is documented as case-insensitive, but when configured with a large host list (100 entries) it becomes case-sensitive due to… HIGH GHSA-5r3v-vc8m-m96g Caddy's FastCGI path splitting logic computes the split index on a lowercased copy of the request path and then uses that byte index to slice the original path. HIGH GHSA-g7pc-pc7g-h8jh Caddy's HTTP path request matcher is intended to be case-insensitive, but when the match pattern contains percent-escape sequences (%xx) it compares against… HIGH GHSA-hffm-g8v7-wrv7 Two swallowed errors in ClientAuthentication.provision() cause mTLS client certificate authentication to silently fail open when a CA certificate file is… HIGH GHSA-j8px-rmrx-76h9 Tested against: caddy:2.11.3 (official Docker image, SHA verified at runtime) MODE GHSA-vcc4-2c75-vc9v Caddy’s stripHTML template function cannot reliably remove all HTML tags from input strings. MODE GHSA-gx7w-56w6-g48x I used an LLM to help review the source code, reason about attack surface, and help draft and refine this report. MODE Show all 19 advisories forwardauth copyheaders deletes the exact client-supplied identity header before copying the trusted value from the auth gateway.
Full advisory text at GitHub advisory , NVD or OSV .
// cvss v3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability None // questions Is github.com/caddyserver/caddy/v2 safe to install? CyberXYZ does not call a package safe in absolute terms. It records 19 known vulnerabilities for github.com/caddyserver/caddy/v2 (go), the worst rated HIGH, and no malicious-package signal. Whether it is acceptable depends on the version you run.
Does github.com/caddyserver/caddy/v2 have known vulnerabilities? Yes. CyberXYZ records 19 known vulnerabilities for github.com/caddyserver/caddy/v2 (go), the worst rated HIGH. These include GHSA-f59h-q822-g45g, GHSA-qrp7-cvwr-j2c6, GHSA-m675-2p33-xv9g, GHSA-x76f-jf84-rqj8, GHSA-5r3v-vc8m-m96g.
How do I check github.com/caddyserver/caddy/v2 before installing? Search github.com/caddyserver/caddy/v2 in CyberXYZ Check at https://cyberxyz.io/check?q=github.com%2Fcaddyserver%2Fcaddy%2Fv2 . The xyz Scanner checks a project's dependencies, and CyberXYZ Proxy checks each package as it is installed.
Checked 2026-11-14 at 07:13 UTC. The most recent advisory here was published 2026-10-28. Updated continuously from NVD, GHSA, OSV and CNA feeds.
Think a verdict here is wrong? Tell us — we respond within 2 business days. Report an issue with this page