Nixpkgs security tracker

Untriaged

Permalink CVE-2026-30851

8.1 HIGH

CVSS version: 3.1
Attack vector (AV): NETWORK
Attack complexity (AC): LOW
Privileges required (PR): LOW
User interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality impact (C): HIGH
Integrity impact (I): HIGH
Availability impact (A): NONE

created 1 month, 2 weeks ago Activity log

Created suggestion 1 month, 2 weeks ago

Caddy forward_auth copy_headers Does Not Strip Client-Supplied Headers, Allowing Identity Injection and Privilege Escalation

Caddy is an extensible server platform that uses TLS by default. From version 2.10.0 to before version 2.11.2, forward_auth copy_headers does not strip client-supplied headers, allowing identity injection and privilege escalation. This issue has been patched in version 2.11.2.

References

https://github.com/caddyserver/caddy/security/advisories/GHSA-7r4p-vjf4-gxv4 x_refsource_CONFIRM
https://github.com/caddyserver/caddy/issues/6610 x_refsource_MISC
https://github.com/caddyserver/caddy/pull/6608 x_refsource_MISC
https://github.com/caddyserver/caddy/pull/7545 x_refsource_MISC

Affected products

caddy

==>= 2.10.0, < 2.11.2

Matching in nixpkgs

pkgs.caddy

Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS

nixos-unstable 2.11.1
- nixpkgs-unstable 2.11.1
- nixos-unstable-small 2.11.1
nixos-25.11 2.10.2
- nixos-25.11-small 2.10.2
- nixpkgs-25.11-darwin 2.10.2

pkgs.xcaddy

Build Caddy with plugins

nixos-unstable 0.4.5
- nixpkgs-unstable 0.4.5
- nixos-unstable-small 0.4.5
nixos-25.11 0.4.5
- nixos-25.11-small 0.4.5
- nixpkgs-25.11-darwin 0.4.5

pkgs.caddyfile-language-server

Basic language server for caddyfile

nixos-unstable 0.4.0
- nixpkgs-unstable 0.4.0
- nixos-unstable-small 0.4.0

pkgs.vimPlugins.nvim-treesitter-parsers.caddy

None

nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
nixos-25.11 -
- nixos-25.11-small
- nixpkgs-25.11-darwin