Nixpkgs security tracker
8.1 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Scope (S): Unchanged (U)
- Confidentiality (C): High (H)
- Integrity (I): High (H)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Unchanged (U)
- Modified Integrity (MI): High (H)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
Caddy: FastCGI header normalization bypass in `forward_auth copy_headers`
Caddy is an extensible server platform that uses TLS by default. Prior to 2.11.4, forward_auth copy_headers deletes the exact client-supplied identity header before copying the trusted value from the auth gateway. But when the request later goes through php_fastcgi, Caddy normalizes HTTP headers into CGI variables by replacing - with _. This lets a client send an underscore alias that survives the forward_auth delete step but becomes the same PHP/FastCGI variable. Result: a remote client can inject or sometimes override identity/group headers trusted by PHP/FastCGI applications behind Caddy. This vulnerability is fixed in 2.11.4.
References
-
https://github.com/caddyserver/caddy/security/advisories/GHSA-f59h-q822-g45g x_refsource_CONFIRM
Affected products
- ==< 2.11.4
Matching in nixpkgs
pkgs.caddy
Fast and extensible multi-platform HTTP/1-2-3 web server with automatic HTTPS
pkgs.xcaddy
Build Caddy with plugins
pkgs.caddyfile-language-server
Basic language server for caddyfile
pkgs.vimPlugins.nvim-treesitter-parsers.caddy
Tree-sitter grammar for caddy
-
nixos-unstable 0.0.0+rev=2686186
- nixpkgs-unstable 0.0.0+rev=2686186
- nixos-unstable-small 0.0.0+rev=2686186
-
nixos-26.05 0.0.0+rev=2686186
- nixos-26.05-small 0.0.0+rev=2686186
- nixpkgs-26.05-darwin 0.0.0+rev=2686186
pkgs.tree-sitter-grammars.tree-sitter-caddyfile
Tree-sitter grammar for caddyfile
-
nixos-unstable 0-unstable-2026-04-06
- nixpkgs-unstable 0-unstable-2026-04-06
- nixos-unstable-small 0-unstable-2026-04-06
-
nixos-26.05 0-unstable-2026-04-06
- nixos-26.05-small 0-unstable-2026-04-06
- nixpkgs-26.05-darwin 0-unstable-2026-04-06
pkgs.vscode-extensions.matthewpi.caddyfile-support
Rich Caddyfile support for Visual Studio Code
pkgs.python313Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
pkgs.python314Packages.tree-sitter-grammars.tree-sitter-caddyfile
Python bindings for tree-sitter-caddyfile
-
nixos-unstable 0+unstable20260406
- nixpkgs-unstable 0+unstable20260406
- nixos-unstable-small 0+unstable20260406
-
nixos-26.05 0+unstable20260406
- nixos-26.05-small 0+unstable20260406
- nixpkgs-26.05-darwin 0+unstable20260406
Package maintainers
-
@techknowlogick techknowlogick <techknowlogick@gitea.com>
-
@stepbrobd Yifei Sun <ysun@hey.com>
-
@ryan4yin Ryan Yin <xiaoyin_c@qq.com>
-
@matthewpi Matthew Penner <me+nix@matthewp.io>
-
@pyrox0 Pyrox <pyrox@pyrox.dev>
-
@adfaure Adrien Faure <adfaure@pm.me>
-
@A-jay98 Ali Jamadi <ali@jamadi.me>
-
@mightyiam Shahar "Dawn" Or <mightyiampresence@gmail.com>
-
@aciceri Andrea Ciceri <andrea.ciceri@autistici.org>