Issues

• Caddy reports "File to import not found" when file exists

  caddyserver/caddy#8161 · opened on Oct 6, 2026

• reverseproxy: random_choose picks the busier host half the time once no upstream is idle

  caddyserver/caddy#8158 · opened on Oct 6, 2026

• reverseproxy: weighted_round_robin panics when there are fewer weights than upstreams and one is down

  caddyserver/caddy#8157 · opened on Oct 6, 2026

• Panic in deferred write-timeout flush when an upgraded (hijacked) connection outlives write_timeout

  caddyserver/caddy#8151 · opened on Oct 5, 2026
  1

• encode: HEAD responses send Content-Length 20 (gzip) / 13 (zstd)

  caddyserver/caddy#8148 · opened on Oct 5, 2026

• templates: a template error keeps file_server's Content-Length, so the 500 has a broken body

  caddyserver/caddy#8147 · opened on Oct 5, 2026

• core: config reload cleans up handler modules while requests are still running

  caddyserver/caddy#8143 · opened on Oct 4, 2026
  2

• Caddy intercepts /.well-known/acme-challenge silently even with a proxy/webroot route override specified.

  caddyserver/caddy#8096 · opened on Oct 1, 2026
  5

• MatchTLS is the only core HTTP matcher without CEL expression support

  caddyserver/caddy#8087 · opened on Sep 30, 2026

• http: on config reload, the grace period context is cancelled as soon as App.Stop returns, so graceful shutdown of the old servers always ends immediately with "context canceled"

  caddyserver/caddy#8078 · opened on Sep 28, 2026
  4

• Expose the negotiated TLS key exchange (curve) as a placeholder and access-log field

  caddyserver/caddy#8065 · opened on Sep 25, 2026
  4

• Feature request: expose version/build info via admin API endpoint

  caddyserver/caddy#8044 · opened on Sep 20, 2026
  3

• caddyauth: basic_auth accepts duplicate usernames that only collide after {env.*} expansion

  caddyserver/caddy#8037 · opened on Sep 19, 2026
  2

• Open redirect on carefully crafted paths

  caddyserver/caddy#8023 · opened on Sep 15, 2026
  10

• strip_path_prefix and handle_path silently fail when the prefix contains non-ASCII characters

  caddyserver/caddy#8001 · opened on Sep 7, 2026
  1

• caddyhttp: support Prometheus native histograms

  caddyserver/caddy#7983 · opened on Sep 2, 2026
  1

• reverse_proxy: slow-start warm-up for newly added or recovered upstreams

  caddyserver/caddy#7966 · opened on Aug 29, 2026
  2

• Flush error logs before process exits

  caddyserver/caddy#7962 · opened on Aug 27, 2026

• Use sync.Map instead of mutex for caching to speed up dynamic SRV lookups of slow queries

  caddyserver/caddy#7946 · opened on Aug 19, 2026
  4

• Add optional Content-Digest headers

  caddyserver/caddy#7901 · opened on Jul 23, 2026
  2

• caddytls: reused certificate cache races with renewal workers during provisioning

  caddyserver/caddy#7897 · opened on Jul 20, 2026
  1

• reverseproxy: add least_latency selection policy (power-of-two-choices + peak-EWMA)

  caddyserver/caddy#7879 · opened on Jul 14, 2026
  6

• reverse_proxy: add per-upstream request/response/duration metrics

  caddyserver/caddy#7844 · opened on Jun 26, 2026
  1

• reverse_proxy: bodyless HTTP/3 client GET forwarded to an HTTP/2 upstream gets ContentLength -1 instead of 0 (regression in v2.9.0)

  caddyserver/caddy#7835 · opened on Jun 23, 2026
  7

• WebSocket header casing normalization reverted when header ops are configured

  caddyserver/caddy#7784 · opened on Jun 1, 2026
  5