WebSocket Header Exposure in Caddy Server Platform

CVE-2026-55458

What is CVE-2026-55458?

The Caddy Server platform, an extensible server that employs TLS by default, contains a vulnerability in its reverse proxy implementation. Prior to version 2.11.5, the 'finalizeResponse' method improperly handles upstream responses for WebSocket connections. This flaw allows an attacker controlling a proxied WebSocket upstream to manipulate hop-by-hop headers, such as Alt-Svc, Keep-Alive, and Proxy-Authenticate, leading to potential header leakage when responding to clients. Consequently, clients may receive manipulated headers that could be misinterpreted as ordinary successful responses, especially under HTTP/2 or HTTP/3 protocols. This issue has been addressed in Caddy version 2.11.5, enhancing the security of its reverse proxy features.

References