# CVE-2026-55458: Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through

Source: https://junglewise.ai/threats/cve-2026-55458-caddy-has-an-rfc-7230-6-1-compliance-issue-hop-by-hop-headers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-05. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-55458 · Severity: medium · CVSS 4 · Published 2026-11-05

Caddy is a reverse proxy that routes web traffic between clients and upstream servers. When handling WebSocket upgrade connections, Caddy fails to strip RFC 7230 hop-by-hop headers (such as Alt-Svc and Proxy-Authenticate) that should never be forwarded to clients. An attacker controlling an upstream server can inject these headers to hijack client connections, inject cookies, or phish for proxy authentication credentials.

Technologies: [Caddy](https://junglewise.ai/threats/technologies/caddy-caddy), [github.com/caddyserver/caddy/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-caddyserver-caddy-v2). Vendors: [Caddy](https://junglewise.ai/threats/vendors/caddy), [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-55458 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55458 being exploited in the wild.

**How severe is CVE-2026-55458?** Medium severity, with a CVSS score of 4, published 5 November 2026.

**Which products and versions are affected?** Caddy <=v2.11.4; github.com/caddyserver/caddy/v2 (Go) <= 2.11.4, SEMVER:introduced=0,fixed=2.11.5.

**Is there a fix for CVE-2026-55458?** Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-55458 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-55458?** Check whether you run Caddy or github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.5 or later

  ```sh
  go get github.com/caddyserver/caddy/v2@v2.11.5
  ```


## Technical details

Caddy's reverse proxy correctly removes hop-by-hop headers for normal HTTP responses via the finalizeResponse method, but the HTTP 101 Switching Protocols code path returns early, bypassing header stripping entirely. In handleUpgradeResponse, all upstream headers are copied to the client without filtering. For HTTP/2 and HTTP/3, the 101 response is converted to 200 OK, causing browsers to process malicious headers like Alt-Svc and Set-Cookie. An unauthenticated attacker with control over an upstream server can inject these headers during WebSocket upgrade requests.

## Affected products

- Caddy Caddy <=v2.11.4

## Identifiers

- CVE-2026-55458
- GHSA-8qx7-j2v2-x6q5
- GO-2026-6874

## Timeline

- 2026-10-28: disclosed
- 2026-10-28: patched

## References

- [https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5](https://github.com/caddyserver/caddy/security/advisories/GHSA-8qx7-j2v2-x6q5)
- [https://github.com/caddyserver/caddy](https://github.com/caddyserver/caddy)

## Related threats

- [Caddy fileHidden case-sensitivity bypass on case-insensitive filesystems](https://junglewise.ai/threats/cve-2026-92700-caddy-is-an-extensible-server-platform-that-uses-tls-by-default)
- [Caddy unbounded body buffer denial of service](https://junglewise.ai/threats/cve-2026-92284-caddy-is-an-extensible-server-platform-that-uses-tls-by-default)
- [Caddy placeholder re-expansion in URI rewrite](https://junglewise.ai/threats/cve-2026-77281-caddy-placeholder-re-expansion-in-uri-rewrite)
- [GO-2026-5408 - Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in…](https://junglewise.ai/threats/go-2026-5408-caddy-remote-admin-authorization-bypass-on-pki-endpoints-4c5e1b8e)
- [GO-2026-5730 - Caddy Fix Bypass in github.com/caddyserver/caddy](https://junglewise.ai/threats/go-2026-5730-caddy-fix-bypass-in-github-com-caddyserver-caddy-baf17ba5)