# CVE-2026-92284: Caddy placeholder re-expansion in URI rewrite

Source: https://junglewise.ai/threats/cve-2026-77281-caddy-placeholder-re-expansion-in-uri-rewrite  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92284 · Severity: medium · CVSS 6.5 · Published 2026-09-17

Caddy is an extensible web server platform that handles HTTPS and request routing. In version 2.11.3 and earlier, a flaw in the URI rewrite handler allows attackers to inject malicious placeholders into query strings, potentially exposing sensitive environment variables, internal request data, or readable files on the server when certain configurations are used.

Technologies: [github.com/caddyserver/caddy/v2 (Go)](https://junglewise.ai/threats/technologies/github-com-caddyserver-caddy-v2). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-92284 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92284 being exploited in the wild.

**How severe is CVE-2026-92284?** Medium severity, with a CVSS score of 6.5, published 17 September 2026.

**Which products and versions are affected?** github.com/caddyserver/caddy/v2 (Go) SEMVER:introduced=0,fixed=2.11.4.

**Is there a fix for CVE-2026-92284?** Yes. github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92284 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-92284?** Check whether you run github.com/caddyserver/caddy/v2 (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- github.com/caddyserver/caddy/v2 (Go): upgrade to 2.11.4 or later

  ```sh
  go get github.com/caddyserver/caddy/v2@v2.11.4
  ```


## Technical details

The vulnerability is a placeholder re-expansion flaw in the rewrite handler (modules/caddyhttp/rewrite/rewrite.go). When a rewrite URI template ends with a literal question mark and contains a placeholder that expands to client-controlled bytes (e.g. {http.request.header.X-Fwd}), those bytes flow into buildQueryString() which performs a second placeholder expansion pass. An attacker can inject placeholder syntax such as {env.SECRET} or {file./path} to disclose environment variables, files, or internal request variables. The attack requires specific rewrite configuration and is network-reachable without authentication. The fix, released in version 2.11.4, escapes curly braces in injected query strings to prevent re-expansion.

## Affected products

- Caddy Caddy 2.11.3 and earlier

## Identifiers

- CVE-2026-92284
- CVE-2026-77281
- CVE-2026-92700
- GHSA-j8px-rmrx-76h9
- GO-2026-6512

## Timeline

- 2026-09-17: disclosed
- 2026-05-26: patched: Fix merged in version 2.11.4

## References

- [https://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb](https://github.com/caddyserver/caddy/commit/176b043b0104cee3f894023cd5a598ac29e404bb)
- [https://github.com/caddyserver/caddy/pull/7761](https://github.com/caddyserver/caddy/pull/7761)

## Related threats

- [Caddy has an RFC 7230 §6.1 compliance issue / Hop-by-hop headers that leak through](https://junglewise.ai/threats/cve-2026-55458-caddy-has-an-rfc-7230-6-1-compliance-issue-hop-by-hop-headers)
- [GO-2026-5408 - Caddy: Remote Admin Authorization Bypass on PKI Endpoints via Prefix-Based Path Matching in…](https://junglewise.ai/threats/go-2026-5408-caddy-remote-admin-authorization-bypass-on-pki-endpoints-4c5e1b8e)
- [GO-2026-5730 - Caddy Fix Bypass in github.com/caddyserver/caddy](https://junglewise.ai/threats/go-2026-5730-caddy-fix-bypass-in-github-com-caddyserver-caddy-baf17ba5)
- [Caddyserver Caddy XSS bypass in stripHTML template function](https://junglewise.ai/threats/cve-2026-52846-caddyserver-caddy-xss-bypass-in-striphtml-template-function)
- [Caddy authentication bypass via FastCGI header normalization collision](https://junglewise.ai/threats/cve-2026-52845-caddy-authentication-bypass-via-fastcgi-header-normalization)