Caddy Web Server v2.11.8 releases with security hardening and Linux capability improvements

The Caddy web server project has released version 2.11.8, a maintenance patch focusing on security hardening and bug fixes. This release addresses several regressions and stability issues, particularly for users running PHP via FastCGI or utilizing specific HTTP/2 and HTTP/3 features.

Key improvements include more granular control over idle timeouts and enhanced support for Linux capabilities. The update also refines how the server handles TLS connection policies and Encrypted ClientHello (ECH) retries, ensuring better compatibility with modern web standards and secure deployment environments like OpenShift.

Technical improvements in Caddy v2.11.8

• Linux Security & Capabilities: Caddy now supports binding privileged ports using fewer capabilities by raising CAP_NET_BIND_SERVICE only during the binding process; this allows for more restrictive systemd units or OpenShift environments using '--cap-drop ALL'.
• Timeout & Protocol Handling: The release implements a hierarchical timeout system where per-route timeouts take precedence over server-wide settings, and fixes an HTTP/2 issue where handlers pausing request body reads previously caused 502 errors.
• PHP/FastCGI Stability: Critical fixes for PHP environments ensure that Location responses without a status code default to 302 redirects and prevent applications that write more data than the declared Content-Length from corrupting HTTP/1.1 or killing HTTP/2 connections.
• TLS & ECH Enhancements: The server now sends retry configurations when rejecting Encrypted ClientHello (ECH) to help clients with stale configurations recover, and improves TLS matcher logic within CEL expressions.
• Reverse Proxy & Load Balancing: Improvements include preserving user-set headers during 1xx Early Hints responses, forwarding request trailer values, and fixing a regression in weighted_round_robin load balancing.

Why it matters

This update is vital for sysadmins and DevOps engineers using Caddy in containerized or highly restricted Linux environments, as it enables better adherence to the principle of least privilege. The fixes for PHP and HTTP/2 stability also provide a more reliable foundation for developers deploying modern web applications via FastCGI or FrankenPHP.