Caddy Web Server v2.11.9 fixes FastCGI security vulnerabilities and PHP regressions

The Caddy web server project has released version 2.11.9, a maintenance update primarily focused on resolving security vulnerabilities and a significant regression introduced in version 2.11.8. The update is particularly critical for users running PHP applications via FastCGI, as it fixes a bug where trailing slashes caused 404 errors on directory indexes, breaking platforms like WordPress.

Beyond functional fixes, the release patches several security issues related to FastCGI, including potential client-side overrides of environment variables and path manipulation risks on Windows. It also introduces breaking changes to ensure stricter security enforcement, such as rejecting conflicting client authentication policies and preventing ambiguous FastCGI script execution.

Technical breakdown of security and functional fixes

• FastCGI Security: Patches prevent clients from overriding server-set HTTP_* variables by ensuring configured environment values take precedence over incoming request headers.
• Path Traversal and Windows Support: Fixes vulnerabilities where NTFS 8.3 short names or alternate data streams could bypass path rules, and rejects FastCGI requests where escaped vs. decoded paths could lead to unintended script execution.
• PHP/WordPress Compatibility: Resolves a regression where requests for directories with trailing slashes matched the directory itself rather than the index file, preventing the request from reaching the PHP handler.
• Configuration Integrity: Implements a breaking change that turns conflicting client_auth settings in shared TLS connection policies into Caddyfile errors to prevent the silent dropping of strict mTLS requirements.
• Performance and API: Reduces memory allocations in path cleaning and header rewriting, and adds a new IsNamedRoute() helper for plugin developers.

Why it matters

System administrators running PHP-based web applications should prioritize this update to restore functionality and secure their FastCGI transport. The stricter handling of FastCGI headers and path matching enhances the security posture of cloud-native deployments against request smuggling and unauthorized variable injection.