Caddy / update detail

v2.11.6

Official Caddy changelog summary with source attribution, release tags, and community reactions.

Track this Caddy release note alongside related changelog updates, risky changes, and weekly digest signals from the developer community.

Caddy·Oct 1, 2026, 03:21 PMFixMay break your integrationAI-assisted summary

Summary

Added URLPattern request matcher, new TLS automate‑names option, expected‑underscore/dot header controls, and HTTP/3 support on low‑MTU links.
Implemented security hardening: default 16 KiB header limit, 1 min idle read/write timeouts, stricter config validation, and multiple CVE‑related fixes.
Breaking changes include requiring Go 1.26, reduced default header size, new idle timeout defaults, and altered client‑auth inheritance behavior.

featurebreakingsecuritybugfixsource failing

Official source Last checked Aug 1, 2026, 2:00 PM

Loading follow options…

official source

Verify the original release note

Every summary should remain traceable to the original changelog or release source.

AI-assisted summarysource failingLast checked Aug 1, 2026, 2:00 PM

related channels

Turn this Caddy release note into a weekly digest for the tools you actually use.