caddyserver/caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
How caddy is put together
Caddy is an extensible, cross-platform HTTPS server platform written in Go, built around a modular plugin architecture where all functionality (including its `http` and `tls` apps) is implemented as registered Caddy modules configured via a native JSON config. Configuration can be supplied as JSON directly or converted from other formats (Caddyfile, YAML, TOML, NGINX, etc.) through config adapters, and is loaded/reloaded at runtime through an admin HTTP API. Its standout capability is automatic HTTPS via ACME (Let's Encrypt/ZeroSSL) powered by the CertMagic library, plus a built-in PKI/CA for internal certificates. Data flows from a config source (file, stdin, or HTTP loader) through an adapter into the core `caddy` package, which provisions module instances that handle HTTP requests, TLS handshakes, and certificate management.
Languages
Frameworks
Datastores
Infrastructure
Major components
caddy core (root package)
Core platform: module registration, context/lifecycle, config loading, admin API, listeners, logging, replacer, and storage abstractions.
caddyconfig
Config adapter framework and loaders (Caddyfile, HTTP loader) plus the admin /load and /adapt endpoints that convert non-JSON configs to Caddy JSON.
caddyconfig/caddyfile & httpcaddyfile
Caddyfile lexer/parser/dispenser and the HTTP-specific Caddyfile-to-JSON adapter with directives, addresses, TLS/PKI app builders.
modules/caddyhttp
The HTTP app: servers, routes, request matchers (including CEL), reverse-proxy support, automatic HTTPS wiring, response writers, and metrics.
modules/caddytls
TLS app: ACME issuer, certificate automation/selection, CA pools, cert/leaf loaders, connection policies, and ECH support.
modules/caddypki
Built-in PKI: local certificate authority, certificate maintenance, crypto helpers, and PKI admin API.
cmd (caddycmd)
Command-line interface: subcommands, config loading/watching, process management, package/plugin helpers, and the caddy binary entrypoint.
caddytest
Integration and end-to-end test harness with fixtures (test certs) exercising ACME, reverse proxy, forward auth, PKI, and Caddyfile adaptation.
A light housekeeping week with a security-related certificate fix, clearer docs, and a lint cleanup.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A light housekeeping week with a security-related certificate fix, clearer docs, and a lint cleanup.
Week of 2026-08-17
Two targeted security fixes closed a connection-stalling attack and a known proxy vulnerability.
Week of 2026-08-10
A busy week combining several security fixes with substantial performance tuning and new logging and networking features.
Week of 2026-08-03
A single small fix prevented log values from being unintentionally overwritten.
Week of 2026-07-27
A mix of correctness fixes and performance improvements across authentication, file browsing, and response handling.
Over the past several weeks, Caddy's maintainers focused heavily on security hardening—closing off traffic-slowing attacks, an authorization bypass, and a known proxy vulnerability—while steadily trimming wasted memory and CPU in the request-handling hot paths. Alongside these, they shipped smaller reliability fixes, clearer documentation, and quality-of-life improvements to logging and certificate handling. The overall arc is one of a mature project tightening its defenses and polishing performance rather than adding large new features.
Week by week
2026-08-24A light housekeeping week with a security-related certificate fix, clearer docs, and a lint cleanup.latest3 changes
Fix
Respect the 'skip trust install' setting for internal certificates
When a site explicitly uses Caddy's internal certificate authority, it now honors the user's choice not to install that authority as trusted on the system.
Docs
Clarify configuration error documentation
Improved the explanation of when a specific 'argument error' is raised so configuration authors get more accurate guidance.
Chore
Fix code-quality warnings from an updated linter
Cleaned up minor style issues flagged by a newer version of the project's automated code checker.
2026-08-17Two targeted security fixes closed a connection-stalling attack and a known proxy vulnerability.2 changes
Fix
Defend against slow-connection ('slowloris') attacks
Added time limits on idle reads and writes so attackers can no longer tie up the server by trickling data very slowly.
Fix
Close the 'HTTPoxy' proxy vulnerability
Fixed a flaw where a malicious request header could hijack how backend applications route their outbound connections.
2026-08-10A busy week combining several security fixes with substantial performance tuning and new logging and networking features.6 changes
Fix
Fix an authorization bypass via disguised slashes in URLs
Blocked a trick where encoded slashes in a web address could sneak past access rules meant to protect certain paths.
Fix
Prevent a wildcard certificate from weakening specific sites' client authentication
Named hostnames are now shielded so a broad catch-all certificate can't relax the stricter client-verification rules they require.
Refactor
Reduce memory and CPU use in request handling
Trimmed unnecessary allocations in the busiest request paths and generated request IDs only when actually needed.
Feature
Add a filter to hide cookie data in logs
Operators can now redact 'Set-Cookie' response headers from their logs to avoid recording sensitive values.
Fix
Keep health-check state separate per configuration
Backend server health checks no longer share state when they use different check settings, avoiding misleading results.
Fix
Log recovered crashes at error level and tidy resource cleanup
Unexpected handler crashes are now reported as errors, and resources are reliably released when operations fail partway.
2026-08-03A single small fix prevented log values from being unintentionally overwritten.1 change
Fix
Protect single-assignment log values from being overwritten
Ensured that log fields meant to be set once can no longer be silently replaced with a different value.
2026-07-27A mix of correctness fixes and performance improvements across authentication, file browsing, and response handling.5 changes
Fix
Prevent authentication providers from overwriting each other
Isolated each authentication method's response so multiple providers can no longer clobber one another's results.
Refactor
Speed up browsing of large directories
Made Caddy's built-in file browser noticeably faster when listing folders with many files.
Fix
Send live-update (server-sent events) headers immediately
Streaming responses now flush their headers right away so real-time updates reach clients without delay.
Refactor
Reduce overhead in content compression and header handling
Cut memory allocations when negotiating compression and reused standard header formatting to avoid repeated work.
Fix
Correctly register nested named routes
Fixed configuration handling so routes that invoke other named routes are all registered properly.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 0 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
No concrete code-level issues confirmed.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required