v1.14.2 v2.11.6
medium risk
caddyserver/caddySep 24, 2026 → Oct 1, 20267 days between releases
What's New
Adds URLPattern matcher and Slowloris mitigation, but requires Go 1.26 and limits headers to 16 KiB.
Breaking Changes
- Go 1.26 is now the minimum version for building Caddy and plugins.
- Request headers are limited to 16 KiB by default (previously 1 MB).
- New 1-minute idle read/write timeouts by default, affecting stalled connections.
- Request header fields containing `.` are now dropped by default.
- Wildcard site `client_auth` no longer applies to specific hostnames with their own site blocks.
New Features
- New `url_pattern` request matcher supporting URLPattern spec.
- New `tls_automate_names` global option to manage certificates.
- New `expected_underscore_headers` server option.
- New `set_cookie` log filter.
- `roll_interval` in logging now accepts days (`d`).
Improvements
- Slowloris mitigation with configurable idle read/write timeouts.
- Reverse proxy improvements including TCP half-close propagation.
- HTTP/3 support over low-MTU links like Tailscale.
- Security hardening for request handling.
Upgrade Notes
You must upgrade your Go toolchain to version 1.26. Review your configuration for request headers containing dots, as they are now dropped by default. Adjust your idle read/write timeouts if you rely on long-lived stalled connections.
The Two Releases
v2.11.6
v2.11.6
Oct 1, 2026· 20 days ago
This patch release introduces a new URLPattern matcher, Slowloris mitigation, and various enhancements to reverse proxy and logging, alongside security hardening.
Full release notes